3 ms·
If any cookie is scoped to `microsoft.com` - wouldn't this subdomain be able to access them?
by philip1209 4y ago
If any cookie is scoped to `microsoft.com` - wouldn't this subdomain be able to access them?
- asddubs 4y agoyes, if the domain parameter of the cookie is explicitly set.
- kevingadd 4y agoIdeally those cookies would also be httponly, so it's harder to get at them
- hsbauauvhabzb 4y agoI’ll preface this with the acknowledgement that httponly is misunderstood by many, but it won’t change anything: HttpOnly only prevents session theft as you cannot read the cookie, but you can still use it. you can still perform actions by sending AJAX requests with cookies attached. In a subdomain takeover you receive cookies on all requests, you can view these irrespective of httponly unless you are limited to controlling html and js of the subdomain (which I think is true of GitHub static sites). HttpOnly is largely a failed mitigation, modern SPAs require access to JWT tokens which compounds that; the solution is to focus on appropriate scoping (to prevent subdomain hijacks having such implications) and preventing XSS.