Github pages is now using github.io domain instead of github.com I've read github explanation but it's still difficult for me to understand the root cause. Why would a domain become a security issue?
The HTTP cookie mechanism allows you to specify the domain a particular cookie is associated with. The domain can be the domain of the page setting the cookie or, more interestingly, one of its superdomains. E.g.
foo.bar.example.com is allowed to set cookies on the
What does this mean for GitHub Pages? Well, subdomains of the
github.com domain are allowed to set cookies on it, meaning they can perform session fixation attacks by providing the browser with an existing session cookie. Here's how a simplified attack scenario would look:
github.com uses a cookie called
SESSION_ID to identify active sessions. This cookie contains a unique hash, long enough to be impossible to to guess. Each hash is associated with server-side session data, i.e. a logged-in user.
Now consider an attacker who sets up a GitHub Page at
evil.github.com. They include some of their evil scripts in the page and then trick a victim to visit it. What does the page do? It sets the
SESSION_ID cookie on the
github.com domain to a valid value known to the attacker. This would cause the victim's browser to effectively log in to GitHub using the credentials provided by the attacker. The attacker could then follow the activity on the account and retrieve any data created by the clueless victim.
Moving GitHub Pages from
github.io fixes the issue, since there are no user accounts or sessions on the new domain.