3 ms·

One common use is to pass session data between subsections of a site. For example, the user logs into www.example.com, and is still logged in when they head ove

One common use is to pass session data between subsections of a site. For example, the user logs into www.example.com, and is still logged in when they head over to store.example.com.

hrjet 13y ago
That could be also implemented in my proposed fix by example.com setting the auth cookies. They will continue to be readable by store.example.com. Sure, it will require a change on the server side, which is a pain. But I can't think of a practical scenario which will be impossible to implement with the proposed fix.
- deleted 13y ago
  [deleted]
- gfodor 13y ago
  Your idea would likely break any site on the internet that uses authentication and subdomins, isn't it clear why this isn't being considered?
  - zaroth 13y ago
    Or sites could opt-in to this with a header? EDIT: homakov says the same thing down thread.
  - hrjet 13y ago
    Yes, it is backwards incompatible. Perhaps it could be enforced in HTTP 2?