3 ms·

using a CNAME to allow third party trackers seems like a horrible idea... You risking exposing cookies and other sensitives data to some third party... I guess

• gruez 6y ago
  It's not any worse than third party scripts, which give you full access to the DOM.
  • colinclerk 6y ago
    It's a different attack vector. Session tokens should be stored in an httpOnly cookie, so they're not accessible to a third party script. CNAMEs could absolutely lead to leaked session tokens, but website owners should already be somewhat accustomed to hiding cookies away from third party subdomains. These days, lots of third party services run on subdomains... blogs, status pages, email click trackers, support desks, etc.
    • gruez 6y ago
      >Session tokens should be stored in an httpOnly cookie, so they're not accessible to a third party script. You can't steal cookies, but you can perform actions as the user, eg. $.post("/api/transfer_funds", {"recipient": "attacker", "amount": 999999})