As per my understanding, if a cookie doesn't have a domain attribute (explicitly telling where this cookie can be used), by default that cookie will be used by the domain which issued it and all its subdomain, but the parent domain of the domain which issued the cookie can't use it.

So if foo.example issued a cookie, it can be used by the subdomain bar.foo.example.com but not it's parent domain i.e. example.com.

Now, suppose I found an XSS vulnerability on foo.example.com and I want to get the cookies of example.com. By any means is that possible? Since by default cookies issued by a subdomain can not be used by it's parent domain, I am not able to figure out any way.


A subdomain can only share a cookie with its parent domain if it is explicitly given in the set-cookie header issued by the server like this:

Set-Cookie: name=value; domain=www.parentdomain.com

Otherwise the cookie is "host only cookie"

To answer your question an xss should not be possible Or i am wrong

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.