The attack vector, which he calls "Session Confusion" is something that arises when a server is serving up multiple apps/domains/subdomains, and using the same

The attack vector, which he calls "Session Confusion" is something that arises when a server is serving up multiple apps/domains/subdomains, and using the same key issuance scheme for sessions across them, without tying them to an app or domain. This can lead to incorrect logic from app developers, e.g. "Anyone with a valid session key for this app must have been granted the key by this app, and therefore have gone through the signup logic." Timely -- I've just been digging through the state of play on session management for web apps, something I haven't worried about for 20 or so years, and the documentation out there is surprisingly chill with regards to best practices, security considerations, etc. I wanted a sort of cookbook that like djb had approved, and there is no such thing that I can find.