Can someone explain to me what cookie tossing is? and how it can be used to hijack someone's session? and also how can we prevent it? I am a bit confused about this subject.
Cookie tossing is an attack which abuses the feature that a subdomain can put a
key=value pair in a cookies which can then also be read by the domain above it. For example, when
security.stackexchange.com sets a cookie,
stackexchange.com will be able to read it. Unfortunately there is no way for
stackexchange.com to see if the
key=value pair comes from
stackexchange.com or from
security.stackexchange.com. So when
stackexchange.com uses the same key for some of its own functionality, it might mistake the value from the subdomain for its own value and treat it as if it set it itself.
This becomes problematic when a website allows untrusted people to host subdomains under its domain. They can then abuse this feature to write manipulated cookie information. The ability to take over a session this way is limited, because the attacker can only write information, not read anything. However, setting arbitrary cookie values can in some cases be used for a CSRF attack or an XSS injection, depending on what the main domain does with the content of the cookie.