I have been reading about cross-subdomain cookie attacks here. A quick overview of how it works (from Wikipedia): A web site www.example.com hands out subdomains to untrusted third parties One such ...
We currently have 2 sites http://www.foo.co.uk and https://secure.foo.com. The www site does not have an SSL certificate and is on a different domain. We have a login button on http://www.foo.co.uk ...
HTTP is a stateless protocol. However, when the user logs into a web application, he likes that some session information be preserved, such that he does not have to login again when he wants to go ...