3 ms·Github wouldn't get baidu's cookies since they're different domains.by jonny_eh 12y agoGithub wouldn't get baidu's cookies since they're different domains.eloisant 12y agoThey could if they put code to read cookies in JS and send them home in the JS included in people's pages.jonny_eh 12y agoGood point, all the more reason page authors should use httpOnly cookies: https://www.owasp.org/index.php/HttpOnly https://www.owasp.org/index.php/HttpOnly