Tagged Questions
8
votes
3answers
192 views
Protecting against cross-subdomain cookie attacks
I have been reading about cross-subdomain cookie attacks here.
A quick overview of how it works (from Wikipedia):
A web site www.example.com hands out subdomains to untrusted third parties
One such ...
4
votes
2answers
380 views
Best way to securely set a session cookie on another domain
We currently have 2 sites http://www.foo.co.uk and https://secure.foo.com.
The www site does not have an SSL certificate and is on a different domain.
We have a login button on http://www.foo.co.uk ...
2
votes
3answers
382 views
Session fixation attack
Given the following conditions,
Session ID does not change upon login
Session ID travels in form of HTTP cookie
There is no cross site scripting/redirection vulnerability on the login page
is it ...
