4 ms·
no, it's already httponly. There is NO WAY to secure your subdomains from such vuln.
by homakov 14y ago
no, it's already httponly. There is NO WAY to secure your subdomains from such vuln.
- yourcelf 14y agoGithub only sets their cookie for "github.com". What I'm suggesting is that they set multiple http-only cookies: one for "github.com", one for ".github.com", another for every subdomain you access -- "pages.github.com", etc. If there's already an http-only _gh_sess cookie for every subdomain I can put scripts on, I won't be able to shadow it with my own _gh_sess cookie.
- homakov 14y agoYou can shadow other httponly cookies too. Any cookies.
- yourcelf 14y agoGot it, thanks. More detail at [1] mentioned by gingerline above: "the secure flag does not prevent a cookie from being overwritten. In fact, a HTTP site can overwrite a cookie with a secure flag, as long as the domain names are related appropriately. The secure flag provides confidentiality protection but not integrity protection." [1] http://security.stackexchange.com/questions/12412/what-cookie-attacks-are-possible-between-computers-in-related-dns-domains-exa http://security.stackexchange.com/questions/12412/what-cooki...