I have been reading about cross-subdomain cookie attacks here.
A quick overview of how it works (from Wikipedia):
- A web site www.example.com hands out subdomains to untrusted third parties
- One such party, Mallory, who now controls evil.example.com, lures Alice to her site
- A visit to evil.example.com sets a session cookie with the domain .example.com on Alice's browser
- When Alice visits www.example.com, this cookie will be sent with the request, as the specs for cookies states, and Alice will have the session specified by Mallory's cookie.
- If Alice now logs on, Mallory can use her account.
We are building a web app where customers will have their own subdomains: