Government URLs that don't end in .gov

Re:Government URLs that don't end in .gov by dec0dedab0de on Sunday July 23, 2023 @12:52PM (#36837156)

This got me thinking about cookie scope, and I have a feeling that domaina.tld. and domainb.tld. is always safer than domaina.gov.tl. and domainb.gov.tld.

I might be way off here, but I think that means either domain could set a gov.tld cookie which is sent to all domains, and if one of them is reading cookies without checking scope it could be a way to send whatever to another server. Or even worse, if one of the sites is using gov.uk cookies for something sensitive, then any of the others could read it.

Does anyone know if browsers have special cookie scope considerations for things like .gov.uk and .co.uk?

[ Parent | on HN ]

Re:Government URLs that don't end in .gov by CodesInChaos on Sunday July 23, 2023 @12:58PM (#36837220)

Browsers use the public suffix list to determine cookie scope. So .co.uk domains are just as isolated from each other as .com domains.

You can even get your own domains added to it, typically because you allow users to host their own content on a subdomain (like github.io for github pages).

https://publicsuffix.org/

[ Parent | on HN ]