Question

If evil.example.com sets a cookie with a domain attribute set to .example.com, a browser will include this cookie in requests to foo.example.com.

The Tangled Web notes that for foo.example.com such cookie is largely indistinguishable from cookies set by foo.example.com. But according to the RFC, the domain attribute of a cookie should be sent to the server, which would make it possible for foo.example.com to distinguish and reject a cookie that was set by evil.example.com.

What is the state of current browsers implementations? Is domain sent back with cookies?

Answer 1

RFC 2109 and RFC 2965 were historical attempts to standardise the handling of cookies. Unfortunately they bore no resemblance to what browsers actually do, and should be completely ignored.

Real-world behaviour was primarily defined by the original Netscape cookie_spec, but this was highly deficient as a specification, which has resulting in a range of browser differences, around –

• what date formats are accepted;
• how cookies with the same name are handled when more than one match;
• how non-ASCII characters work (or don’t work);
• quoting/escapes;
• how domain matching is done.

RFC 6265 is an attempt to clean up this mess and definitively codify what browsers should aim to do. It doesn’t say browsers should send domain or path, because no browser in history has ever done that.

Because you can’t detect that a cookie comes from a parent domain(*), you have to take care with your hostnames to avoid overlapping domains if you want to keep your cookies separate – in particular for IE, where even if you don’t set domain, a cookie set on example.com will always inherit into foo.example.com.

So: don’t use a ‘no-www’ hostname for your site if you think you might ever want a subdomain with separate cookies in the future (that shouldn’t be able to read sensitive cookies from its parent); and if you really need a completely separate cookie context, to prevent evil.example.com injecting cookie values into other example.com sites, then you have no choice but to use completely separate domain names.

An alternative that might be effective against some attack models would be to sign every cookie value you produce, for example using an HMAC.

*: there is kind of a way. Try deleting the cookie with the same domain and path settings as the cookie you want. If the cookie disappears when you do so, then it must have had those domain and path settings, so the original cookie was OK. If there is still a cookie there, it comes from somewhere else and you can ignore it. This is inconvenient, impractical to do without JavaScript, and not watertight because in principle the attacker could be deleting their injected cookies at the same time.