4 ms·

IANASE, but that should work, so long as you're diligent about keeping everything that requires a login quarantined to a separate subdomain. Once you leak a coo

IANASE, but that should work, so long as you're diligent about keeping everything that requires a login quarantined to a separate subdomain. Once you leak a cookie over to the public side, it's over.

nodata 13y ago
So set the secure flag on the cookie.
theGimp 13y ago
It doesn't have to be on a separate subdomain -- setting a secure flag should provide sufficient protection.