the-web-application-hackers-handbook

Chapter 7 n Attacking Session Management 245
The cookie mechanism allows a server to specify both the domain and the
URL path to which each cookie will be resubmitted. To do this, it uses the domain
and path attributes that may be included in the Set-cookie instruction.
Cookie Domain Restrictions
When the application residing at foo.wahh-app.com sets a cookie, the browser
by default resubmits the cookie in all subsequent requests to foo.wahh-app
.com, and also to any subdomains, such as admin.foo.wahh-app.com. It does
not submit the cookie to any other domains, including the parent domain
wahh-app.com and any other subdomains of the parent, such as bar.wahh-app.com.
A server can override this default behavior by including a domain attribute
in the Set-cookie instruction. For example, suppose that the application at foo
.wahh-app.com returns the following HTTP header:
Set-cookie: sessionId=19284710; domain=wahh-app.com;
The browser then resubmits this cookie to all subdomains of wahh-app.com,
including bar.wahh-app.com.
NOTE A server cannot specify just any domain using this attribute. First, the
domain specified must be either the same domain that the application is running
on or a domain that is its parent (either immediately or at some remove).
Second, the domain specified cannot be a top-level domain such as .com or
.co.uk, because this would enable a malicious server to set arbitrary cookies
on any other domain. If the server violates one of these rules, the browser
simply ignores the Set-cookie instruction.
If an application sets a cookie’s domain scope as unduly liberal, this may
expose the application to various security vulnerabilities.
For example, consider a blogging application that allows users to register,
log in, write blog posts, and read other people’s blogs. The main application is
located at the domain wahh-blogs.com. When users log in to the application,
they receive a session token in a cookie that is scoped to this domain. Each user
can create blogs that are accessed via a new subdomain that is prefixed by his
username:
herman.wahh-blogs.com
solero.wahh-blogs.com
Because cookies are automatically resubmitted to every subdomain within
their scope, when a user who is logged in browses the blogs of other users,
his session token is submitted with his requests. If blog authors are permitted
to place arbitrary JavaScript within their own blogs (as is usually the case in