Subject: Re: [http-state] Security considerations overview

From: Dan Witte <[email-masked]>
Date: Wed, 3 Mar 2010 16:35:10 -0800 (PST)

----- "Mark Pauley" <[email-masked]> wrote:

> It would appear that this is covered by 4.1.2.2
> 
> We (and many other browsers) do allow setting a cookie with domain
> .bar.example.com from .foo.example.com

Hmm, interesting. Firefox certainly doesn't do that; we (always) have required that the host domain be equal to, or a subdomain of, the 'domain' attribute; and that the 'domain' attribute must not be a TLD.

http://mxr.mozilla.org/mozilla-central/source/netwerk/cookie/src/nsCookieService.cpp#2142

Do you know which other browsers behave like this?

Regards,
Dan.