3 ms·
CNAME wouldn’t work because then the cookie is bound to that domain. So the identity doesn’t travel from website to website.
by WirelessGigabit 4y ago
CNAME wouldn’t work because then the cookie is bound to that domain. So the identity doesn’t travel from website to website.
- EGreg 4y agoWell, yes and no First of all, the subdomain can redirect to google.com and back, loading it in a first-party context, and then redirect to your main domain page. I guess Google here would be a “second party”. https://learn.microsoft.com/en-us/azure/active-directory/develop/reference-third-party-cookies-spas https://learn.microsoft.com/en-us/azure/active-directory/dev... Second way is that subdomain can load an iframe from google.com and the iframe will send a postMessage to the enclosing page, which will send a request to the server to set a cookie. As long as you logged in ONCE in google (let’s say in a popup, or maybe using ITP’s click-to-login) then it will store the session cookie this way. And after that it can meep a cookie around for 10 years and track this guy across all the subdomains where he signed in once.