Security Policy for Cookies
We discussed the semantics of HTTP cookies in Chapter 3, but that discussion left out one important detail: the security rules that must be implemented to protect cookies belonging to one site from being tampered with by unrelated pages. This topic is particularly interesting because the approach taken here predates the same-origin policy and interacts with it in a number of unexpected ways.
Cookies are meant to be scoped to domains, and they can’t be limited easily to just a single hostname value. The domain parameter provided with a cookie may simply match the current hostname (such as foo.example.com), but this will not prevent the cookie from being sent to any eventual subdomains, such as bar.foo.example.com. A qualified ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access