News for hackers. Stuff that matters.

A comment on Should you use www or not in your domain? (2017). Parent comment

Re:Should you use www or not in your domain? (2017) by calibas on Sunday November 11, 2018 @11:32AM (#18427152)
Sending session tokens to every subdomain, and also potentially leaking other sensitive data, is a pretty strong case in my opinion.

Of course, this isn't something that has a concrete right and wrong answer. It's more a question of how much you trust your subdomains. Personally, I think sharing that information should be a conscious choice when setting the cookies and not something that you let happen by default.

[ Parent | on HN ]
Re:Should you use www or not in your domain? (2017) by SlowRobotAhead on Sunday November 11, 2018 @08:59PM (#18430052)
I agree. It doesn’t exactly seem like edge cases to not want to propagate front end cookies to internal services. IDK, seems like an issue with cookies just as much as www or no-www.
[ Parent | on HN ]