3 ms·
It's a different attack vector. Session tokens should be stored in an httpOnly cookie, so they're not accessible to a third party script. CNAMEs could absolut
by colinclerk 6y ago
It's a different attack vector.
Session tokens should be stored in an httpOnly cookie, so they're not accessible to a third party script.
CNAMEs could absolutely lead to leaked session tokens, but website owners should already be somewhat accustomed to hiding cookies away from third party subdomains. These days, lots of third party services run on subdomains... blogs, status pages, email click trackers, support desks, etc.
- gruez 6y ago>Session tokens should be stored in an httpOnly cookie, so they're not accessible to a third party script. You can't steal cookies, but you can perform actions as the user, eg. $.post("/api/transfer_funds", {"recipient": "attacker", "amount": 999999})