6 ms·
Leaking cookies to subdomains IS a problem, but it shouldn't be too big of a deal security-wise if they are encrypted (as they usually are).
by walden42 12y ago
Leaking cookies to subdomains IS a problem, but it shouldn't be too big of a deal security-wise if they are encrypted (as they usually are).
- staunch 12y agoNo, it's always a security problem. http://en.wikipedia.org/wiki/Session_hijacking http://en.wikipedia.org/wiki/Session_hijacking
- tdammers 12y agoAssuming you're referring to the "SECURE" flag; this flag merely instructs the browser to only send the cookie over HTTPS (never plain HTTP), but the browser will merrily send it to any server that matches the cookie domain, and the way HTTPS works, this means whoever receives the cookie will be legitimately able to decrypt it.