Tagged Questions
8
votes
2answers
187 views
User-specific Subdomains : JavaScript security
If I provide a public-facing website for users on my website at their own subdomain (e.g. bob.myapp.com) under their own control, can I allow them to execute arbitrary JavaScript without putting my ...
10
votes
2answers
701 views
What is the point of the same-domain rule for xmlhttprequest when script tags/JSONP can cross domains?
I get that I don't want a page loaded from stackoverflow.com to be able to request gmail.com on my behalf and read my email--but this seems to be simply a cookie issue.
Since JSONP bypasses ...
3
votes
1answer
1k views
cookie path protection within same domain
The answer to this question about how cookies are potentially vulnerable between sub-domains sparked my curiosity.
As far as I know, if a cookie is set on a sub-path of the same domain ...
