As per my understanding, if a cookie doesn't have a domain attribute (explicitly telling where this cookie can be used), by default that cookie will be used by the domain which issued it and all its subdomain, but the parent domain of the domain which issued the cookie can't use it.

So if foo.example issued a cookie, it can be used by the subdomain bar.foo.example.com but not it's parent domain i.e. example.com.

Now, suppose I found an XSS vulnerability on foo.example.com and I want to get the cookies of example.com. By any means is that possible? Since by default cookies issued by a subdomain can not be used by it's parent domain, I am not able to figure out any way.


1 Answer 1


A subdomain can only share a cookie with its parent domain if it is explicitly given in the set-cookie header issued by the server like this:

Set-Cookie: name=value; domain=www.parentdomain.com

Otherwise the cookie is "host only cookie"

To answer your question an xss should not be possible Or i am wrong

You must log in to answer this question.