3 ms·

But I can throw in an iframe or something to get your browser to make a request against that domain (and get a cookie)

• nbpoole 13y ago
  You can't just read cookies for arbitrary domains in an iframe.