2018: You CNAME subdomain.microsoft.com. to blahblahblah.heroku.com. 2019: You replace blahblahblah and shut it down on Heroku 2020: An attacker creates blahb

2018: You CNAME subdomain.microsoft.com. to blahblahblah.heroku.com. 2019: You replace blahblahblah and shut it down on Heroku 2020: An attacker creates blahblahblah.heroku.com. and can now read and write cookies for *.microsoft.com. Replace Heroku with any off-domain hosting service that lets you register a vanity or predictable hostname rather than assigning a GUID.