4 ms·

Why isn't the obvious fix discussed: Change browsers to not let subdomains set cookies for parent domains. Probably this feature is of critical use. If so, wou

• _delirium 13y ago
  One common use is to pass session data between subsections of a site. For example, the user logs into www.example.com, and is still logged in when they head over to store.example.com.
  • hrjet 13y ago
    That could be also implemented in my proposed fix by example.com setting the auth cookies. They will continue to be readable by store.example.com. Sure, it will require a change on the server side, which is a pain. But I can't think of a practical scenario which will be impossible to implement with the proposed fix.
    • deleted 13y ago
      [deleted]
    • gfodor 13y ago
      Your idea would likely break any site on the internet that uses authentication and subdomins, isn't it clear why this isn't being considered?
      • zaroth 13y ago
        Or sites could opt-in to this with a header? EDIT: homakov says the same thing down thread.
      • hrjet 13y ago
        Yes, it is backwards incompatible. Perhaps it could be enforced in HTTP 2?