News for hackers. Stuff that matters.

A comment on GitHub Community Forum. Parent comment

Re:GitHub Community Forum by wyldfire on Tuesday November 14, 2017 @09:50AM (#15695437)
But isn't that governed by the same origin policy, which cares about specific hosts (so a subdomain would be equally effective)?
[ Parent | on HN ]
Re:GitHub Community Forum by hdhzy on Tuesday November 14, 2017 @01:22PM (#15697696)
Subdomain can set a cookie for root domain [0] and that can lead to session fixation attacks. Cookies are not subject to CORS.

[0]: https://www.mxsasha.eu/blog/2014/03/04/definitive-guide-to-c...

[ Parent | on HN ]