The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

A server cannot specify just any domain using this attribute. First, the

domain specified must be either the same domain as the application is running

on or a domain that is its parent (either immediately or at some remove).

Second, the domain specified cannot be a top-level domain such as

.com

or

.co.uk

, because this would enable a malicious server to set arbitrary cookies

on any other domain. If the server violates one of these rules, the browser will

simply ignore the 

Set-cookie

instruction.

If an application sets a cookie’s domain scope as unduly liberal, this may

expose the application to various security vulnerabilities.

For example, consider a blogging application that allows users to register,

log in, write blog posts, and read other people’s blogs. The main application is

located at the domain 

wahh-blogs.com

, and when users log in to the applica-

tion they receive a session token in a cookie that is scoped to this domain. Each

user is able to create blogs that are accessed via a new subdomain which is pre-

fixed by their username, for example:

herman.wahh-blogs.com

solero.wahh-blogs.com