Contents
Please everyone note that you can set a cookie from a subdomain on a domain. (sent in the response for requesting subdomain.mydomain.com) But you CAN’T set a cookie from a domain on a subdomain. (sent in the response for requesting mydomain.com)
I’m aware of a few approaches: hub sets the cookie on example.com This works, but the cookie propagates to other subdomains. Also a risky subdomain like lab could set the cookie. learn provides a setCookie controller.
How to protect against cross subdomain Cookie attacks?
Public Suffix has a list of domains that all vendors (Chrome/Firefox/IE/Safari/Opera) use to avoid this problem of stealing cookies from other subdomains (along side other features). The list is updated daily and is maintained on Github.
When to reject a cookie for a domain?
To prevent possible security or privacy violations, a user agent rejects a cookie (shall not store its information) if any of the following is true: The request-host is a Fully-Qualifed Domain Name (not IP address) and has the form HD, where D is the value of the Domain attribute, and H is a string that contains one or more dots.
Instead, you can consider a cookieless subdomain is a term to describe data transferring from one point to another (in this case, data movement from subdomain to domain) has no cookies attached. Indirectly, this boost the loading speed of your domain.
Weak Integrity Cookies do not provide integrity guarantees for sibling domains (and their subdomains). For example, consider foo.example.com and bar.example.com.
Where do I find the cookie in JavaScript?
When we are on foo.bar.com domain, the cookie will be available on *.bar.com subdomains. But when we are on foo.co.uk domain, the cookie will be available on *.foo.co.uk subdomains. This code works fine on our production environment on thousands of different domains.