I have a web-site written in
nginx.conf — http://mdoc.su/ — which essentially accepts two parameters, an operating system and a manual page name, and does a redirect to a different site based on the parameters in the URL.
Since the intention is that the site is to be navigated and used directly from the Location bar of the browser, every character counts, and I want to make it possible to have a
location that would set a cookie through a regular
GET request, such that further requests for manual pages can be done without specifying an operating system.
However, I realised that if I unconditionally set a preference/cookie based on a parameter in the URL, then it would make my site subject to XSS, since any other webpage could construct a malicious cookie-setting URL, and load it in the background, amending cookies for my site, and breaking the security paradigm.
What is the solution? Can I not set cookies securely in a language like
nginx.conf that carries no state between requests?