3 ms·

> So long as you don't read root cookies I wonder how many web apps are coded to reject cookies from a parent domain when they're expecting specific-subdomain

• true_religion 15y ago
  Now that you mention it... I looked did a little investigation and it turns out you can't tell where a cookie comes from. document.cookie in javascript just returns a string, and HTTP_COOKIE doesn't have any identifying information. So yes, you're right. I was wrong. You can get poisoned by cookies on a root and there's really nothing you can do about it except hope that your browser is smart enough to make prefer your good.example.com cookies as opposed to the root cookies set by evil.example.com