4 ms·
Could a site fix this by delegating a subdomain or CNAME to the SSO provider like sso-company.example.com so that the cookie is still using the same domain, but
by LinuxBender 6y ago
Could a site fix this by delegating a subdomain or CNAME to the SSO provider like sso-company.example.com so that the cookie is still using the same domain, but pointing the IP to the SSO provider? Assuming the SSO provider supports this, that is. I believe OKTA supports this method.
- lancesells 6y agoI believe so. That is what ad tech companies are now doing to get past the improved privacy measures.
- ficklepickle 6y agoI regularly use nginx to reverse proxy third-party API calls. I use it to protect API keys. In my case, I strip all cookies and sensitive headers. One must keep in mind that the browser will treat it as a first-party request and the security implications that has. You may have to filter or modify cookies/headers. https://jeremypoole.ca/posts/protecting_api_keys_on_the_front_end/ https://jeremypoole.ca/posts/protecting_api_keys_on_the_fron...
- cratermoon 6y agoThat is the preferred solution if you're using cookies across a company.
- hinkley 6y agoI mean effectively today hardware you or your boss owns is doing most of the work of tracking yourself. This is making them have to allocate resources to achieve the same effect. Like taking lojack off of your car and phone, and making 'Them' have to tail you and scour security footage like in the old days. It's more expensive. Expensive things do not scale, so you have to prioritize who is worth the cost. People who are under legitimate suspicion of causing harm. Less 'by-catch' to use a commercial fishing concept. When it's cheap to harass everyone, nobody is 'safe'. But when terrorists can't be tracked at all, nobody is 'safe' either. So we have checks and balances.