Timeline for Cookie domain security
Current License: CC BY-SA 4.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| S Jun 9, 2021 at 6:46 | history | suggested | Matt Simerson | CC BY-SA 4.0 |
fix typo: sing-on -> sign-on
|
| Jun 8, 2021 at 23:10 | review | Suggested edits | |||
| S Jun 9, 2021 at 6:46 | |||||
| May 16, 2020 at 13:54 | comment | added | mentallurg | In such scheme when every subdomain belongs to different customers they should understand that using more generic names like .example.com can lead to problems because other subdomains can read and write such cookies. That's why if one cares about security they will not set cookies to domain levels higher than their subdomain. Thus they will be isolated from the others. Thus neither the the owner of www.example.com nor the owner of user1.example.com will want to set cookies at example.com level. | |
| May 16, 2020 at 13:43 | comment | added | Maikkeyy | Alright, so technically there is no difference between www.example.com, user1.example and user2.example.com in terms of subdomain characteristics? I always thought that www. was a special preserved subdomain, but apparently it isn't. But user1.example.com can set a cookie with domain value .example.com which then also gets send to www.example.com, or isn't this any kind of a problem because the main site can ignore this cookie? | |
| May 16, 2020 at 13:40 | vote | accept | Maikkeyy | ||
| May 16, 2020 at 13:35 | comment | added | mentallurg | 1) It's up to you to use subdomains below www. Technically there is no restriction. 2) If yoiu give subdomains to customers, they should not be below domain you user for your own purposes. Thus they should be directly below TLD, not below www. I.e. they should be user1.example.com, user2.example.com, etc. | |
| May 16, 2020 at 8:10 | comment | added | Maikkeyy | This makes it a lot more clear! So if you set a more specific domain AND do want to host user-hosted content, then the only option is to move it to a completely different domain altogether? Because otherwise you would still have the same problem (don't know if you can go lower than .www), correct? Or can you use www.example.com as your main site and next to that use user2.example.com without the .www prefix? Thanks! | |
| May 16, 2020 at 1:32 | history | answered | mentallurg | CC BY-SA 4.0 |