3 ms·
But aren't there other aspects of same-origin policy that could bite you if you outsource static.example.com too? E.g., it may not stop static.example.com from
by marshray 15y ago
But aren't there other aspects of same-origin policy that could bite you if you outsource static.example.com too?
E.g., it may not stop static.example.com from setting malicious cookies at the root.
- true_religion 15y ago> static.example.com from setting malicious cookies at the root. It does. Subdomains can't set cookies for other subdomains. So long as you don't read root cookies, you'll be fine even if you do put static.example.com on some companies box that gets hacked without your knowledge. However, outside of hacking (which is an issue no matter how you layout your domains), I can't think of a single problem with www-.
- marshray 15y ago> So long as you don't read root cookies I wonder how many web apps are coded to reject cookies from a parent domain when they're expecting specific-subdomain cookies?
- true_religion 15y agoNow that you mention it... I looked did a little investigation and it turns out you can't tell where a cookie comes from. document.cookie in javascript just returns a string, and HTTP_COOKIE doesn't have any identifying information. So yes, you're right. I was wrong. You can get poisoned by cookies on a root and there's really nothing you can do about it except hope that your browser is smart enough to make prefer your good.example.com cookies as opposed to the root cookies set by evil.example.com