Re:Ask HN: For a startup which SSL certificate authority wou...
by marshray on Monday January 02, 2012 @03:07AM
(#3415217)
You should fully understand the same-origin implications of such a design before deploying it.
For example, if <<customername>> is able to set cookies or run script (e.g., via XSS), they will be able to set cookies that affect everything under <<mydomain>>.com. Under some circumstances they will even be able to read back the values.
For example, if <<customername>> is able to set cookies or run script (e.g., via XSS), they will be able to set cookies that affect everything under <<mydomain>>.com. Under some circumstances they will even be able to read back the values.
Here's a good site to keep you awake at night: http://lcamtuf.blogspot.com/2010/10/http-cookies-or-how-not-...