> On 26 Sep 2021, at 11:28, Jim Manico <[email protected]> wrote: > > > That’s why cookies should be set with the __Host- prefix. > > You can also set the domain of a cookie to actually be a host (subdomain). > Does that also prevent subdomains from clobbering root directory cookies
No, sadly not. You can set a cookie with domain set to payments.example.com but then I can hijack foo.example.com and set my own cookie with domain=example.com and the server will be none the wiser. Cheers, Neil -- Manage My Preferences <https://preferences.forgerock.com/>, Unsubscribe <https://preferences.forgerock.com/> _______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
