146 reputation
3
bio website
location
age
visits member for 1 year, 11 months
seen Apr 12 at 23:15

Dec
24
awarded  Popular Question
Dec
16
awarded  Supporter
Apr
6
comment Protecting against cross-subdomain cookie attacks
I am currently forcing session ids to be stored in cookies. All session data is stored on the server and we are regenerating the id when the user logs on and logs off. The idea of something like *.googleusercontent.com is interesting. But in this case, wouldn't a.googleusercontent.com still be able to attack b.googleusercontent.com?
Apr
6
awarded  Student
Apr
6
asked Protecting against cross-subdomain cookie attacks