Re:We handled a recent phishing incident that targeted Dropbox
by mschuster91 on Tuesday November 01, 2022 @02:48PM
(#33425685)
Subdomains usually get all the cookies from the main domain (or at least they used to, didn't follow up on that issue for some years).
[ Parent
| on HN ]
Re:We handled a recent phishing incident that targeted Dropbox
by cuttysnark on Tuesday November 01, 2022 @03:54PM
(#33426573)
It's the opposite. Set-Cookie takes the optional Domain attribute and "If omitted, this attribute defaults to the host of the current document URL, not including subdomains." However, perhaps you're remembering "Multiple host/domain values are not allowed, but if a domain is specified, then subdomains are always included." [0]
[0] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Se...