Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 7 down vote favorite
2

The latest article that I have been able to find about Cross-Site cooking was stating that it was possible to set cookie on 2 dots top level domain such as .co.uk.

The mechanism for preventing overly relaxed cookie domain specification seems to be broken in all major browsers.

However this article is dated of 2006. Is this affirmation still true ?

share|improve this question
You may wish to edit your post to refer to the baked goods rather than the process of creating them. – Zian Choy Nov 23 '10 at 6:05

1 Answer

up vote 5 down vote

It is believed that browsers can deal with this issue today. However, this is not only the problem of browsers and they are not the general cause of this failure. But to make my answer complete, I would like to direct you to good blog post that is written by Michal Zalewski: http://lcamtuf.blogspot.com/2010/10/http-cookies-or-how-not-to-design.html.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.