3 ms·

Wonder if there are any cookies that would be able to access..

• hsbauauvhabzb 4y ago
  By default cookies are scoped to the subdomain only, so while not impossible some other domain would have to go out if it’s way to screw that up
  • philip1209 4y ago
    If any cookie is scoped to `microsoft.com` - wouldn't this subdomain be able to access them?
    • asddubs 4y ago
      yes, if the domain parameter of the cookie is explicitly set.
    • kevingadd 4y ago
      Ideally those cookies would also be httponly, so it's harder to get at them
      • hsbauauvhabzb 4y ago
        I’ll preface this with the acknowledgement that httponly is misunderstood by many, but it won’t change anything: HttpOnly only prevents session theft as you cannot read the cookie, but you can still use it. you can still perform actions by sending AJAX requests with cookies attached. In a subdomain takeover you receive cookies on all requests, you can view these irrespective of httponly unless you are limited to controlling html and js of the subdomain (which I think is true of GitHub static sites). HttpOnly is largely a failed mitigation, modern SPAs require access to JWT tokens which compounds that; the solution is to focus on appropriate scoping (to prevent subdomain hijacks having such implications) and preventing XSS.