Re:We handled a recent phishing incident that targeted Dropbox
by chias on Tuesday November 01, 2022 @02:39PM
(#33425530)
Why not just use a subdomain? This is, arguably, what subdomains are for.
Re:We handled a recent phishing incident that targeted Dropbox
by mschuster91 on Tuesday November 01, 2022 @02:48PM
(#33425685)
Subdomains usually get all the cookies from the main domain (or at least they used to, didn't follow up on that issue for some years).
Re:We handled a recent phishing incident that targeted Dropbox
by cuttysnark on Tuesday November 01, 2022 @03:54PM
(#33426573)
It's the opposite. Set-Cookie takes the optional Domain attribute and "If omitted, this attribute defaults to the host of the current document URL, not including subdomains." However, perhaps you're remembering "Multiple host/domain values are not allowed, but if a domain is specified, then subdomains are always included." [0]
[0] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Se...
Re:We handled a recent phishing incident that targeted Dropbox
by getcrunk on Tuesday November 01, 2022 @02:48PM
(#33425673)
Can you give an example of what it means for a subdomain to not be walled off?
If I'm Example Ltd. and my customers are trusting me to keep their data on example.com safe, and I use example.blog for my blog hosted by Jimbo's Blogging Service, I don't need to worry about Jimbo or his employees setting/reading my user's cookies, local storage, etc. With blog.example.com, it'd be really easy to leak information.