Hacker News new | ask | show | jobs
by yahelc 3226 days ago
No, cookies can be restricted to paths, it's just less commonly utilized.

https://developer.mozilla.org/en-US/docs/Web/API/Document/co...
1 comments
tptacek 3226 days ago
They can be, but the restriction isn't useful, because the Javascript same-origin policy doesn't reliably defend the boundary.
link
dgoldstein0 3226 days ago
exactly. It still boggles my mind that browsers don't send up the path and domain of a cookie when sending the name & value with a request.

for anyone interested in the topic, https://www.usenix.org/system/files/conference/usenixsecurit... is a must read

link