4 ms·

Whether they’re malicious or not, I don’t want to send them the session cookie for an unrelated website.

by notriddle 4y ago

saurik 4y ago
So scope cookies to the SSL certificate instead of the domain name, or simply offer to clear them for a domain whenever you bypass the HSTS on one.
- duskwuff 4y ago
  > So scope cookies to the SSL certificate And invalidate every user's session whenever the server's certificate is renewed??