1) simulate request to http(NOT SECURE)://site.com 2) simulate response with Set-Cookie: csrf_token=123123; > unless it's a subdomain in which you have the mor

1) simulate request to http(NOT SECURE)://site.com 2) simulate response with Set-Cookie: csrf_token=123123; > unless it's a subdomain in which you have the more serious issue of session theft or session fixation elaborate plz? From what I know, subdomain can only do same attack (cookie tossing). Are you talking about phishing?