156 reputation
5
bio website
location
age
visits member for 2 years, 5 months
seen Oct 17 at 5:17

Jun
10
comment Protecting against cross-subdomain cookie attacks
This wouldn't really help if we store only the session id in the cookie and store session data on the server.
Jun
6
awarded  Editor
Jun
6
comment Is it possible to prevent attackers from destroying sessions using cookie tossing and cookie overflow attacks?
@atk I have updated my question with the github post where these terms were used: github.com/blog/1466-yummy-cookies-across-domains
Jun
6
revised Is it possible to prevent attackers from destroying sessions using cookie tossing and cookie overflow attacks?
added 227 characters in body
Jun
6
asked Is it possible to prevent attackers from destroying sessions using cookie tossing and cookie overflow attacks?
Jun
5
awarded  Nice Question
Dec
24
awarded  Popular Question
Dec
16
awarded  Supporter
Apr
6
comment Protecting against cross-subdomain cookie attacks
I am currently forcing session ids to be stored in cookies. All session data is stored on the server and we are regenerating the id when the user logs on and logs off. The idea of something like *.googleusercontent.com is interesting. But in this case, wouldn't a.googleusercontent.com still be able to attack b.googleusercontent.com?
Apr
6
awarded  Student
Apr
6
asked Protecting against cross-subdomain cookie attacks