4 ms·
Yeah, this is just standard third-party cookie functionality, which has always been sketchy. It honestly seems like it was only possible by accident; browsers h
by saghm 5d ago
Yeah, this is just standard third-party cookie functionality, which has always been sketchy. It honestly seems like it was only possible by accident; browsers have long prevented sites from reading cookies from other domains, but it seems like the people working on early specs might not have considered the ramifications of being able to set cookies for domains other than your own. A couple decades ago it might have seemed like no one would have any reason to set a cookie they couldn't read.
- hansvm 5d agoMaybe 3 decades ago people had excuses, but the latest decade of cookie abuses have been designed by people who not only knew better but who took that better world into account as they buried it away from the general public. The fact that half a million developers think CORS is a server security measure isn't an accident.