Github pages is now using github.io domain instead of github.com I've read github explanation but it's still difficult for me to understand the root cause. Why would a domain become a security issue?


The HTTP cookie mechanism allows you to specify the domain a particular cookie is associated with. The domain can be the domain of the page setting the cookie or, more interestingly, one of its superdomains. E.g. foo.bar.example.com is allowed to set cookies on the foo.bar.example.com, bar.example.com and example.com domains.

What does this mean for GitHub Pages? Well, subdomains of the github.com domain are allowed to set cookies on it, meaning they can perform session fixation attacks by providing the browser with an existing session cookie. Here's how a simplified attack scenario would look:

Let's say github.com uses a cookie called SESSION_ID to identify active sessions. This cookie contains a unique hash, long enough to be impossible to to guess. Each hash is associated with server-side session data, i.e. a logged-in user.

Now consider an attacker who sets up a GitHub Page at evil.github.com. They include some of their evil scripts in the page and then trick a victim to visit it. What does the page do? It sets the SESSION_ID cookie on the github.com domain to a valid value known to the attacker. This would cause the victim's browser to effectively log in to GitHub using the credentials provided by the attacker. The attacker could then follow the activity on the account and retrieve any data created by the clueless victim.

Moving GitHub Pages from github.com to github.io fixes the issue, since there are no user accounts or sessions on the new domain.

| improve this answer | |
  • thank you for your brief explanation. Another question arise: is this issue would affect any other user-generated subdomain? Example wordpress.com/blogger.com and so on. Or this vulnerability only applies to GitHub pages since only at GitHub pages, an attacker could write malicious code. – zakiakhmad Jun 10 '14 at 4:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.