Using Nginx, I hope to restrict the permissible hosts for cookies. My initial intention was to employ a Content Security Policy for this purpose, but I don't see an obvious way to do this via a CSP. Ideally I'd find something like

Restrict-Cookies-Header: hostname1.tld hostname2.tld2

Can something like this be accomplished with HTTP headers? Thanks!

  • 1
    Are you trying to restrict what hosts the browser will send your cookies to, or restrict what 3rd party sites can set cookies? – multithr3at3d May 20 '20 at 23:52
  • Restrict what 3rd party resources can set cookies – Alex V May 21 '20 at 0:12
  • 1
    @Alex: The basic design of how cookies work includes already that domain A cannot set or read a cookie for domain B. So it is unclear for me what you are trying to achieve. – Steffen Ullrich May 21 '20 at 5:11
  • Well, the situation was that I had an iframe to a 3rd party site that set tracking cookies (on its own domain). I did not want my users to be tracked like that. It turns out I can accomplish this by setting the sandbox property of the iframe. I should have been clearer about my actual use case, sorry! – Alex V May 21 '20 at 23:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.