[JIRA] (IDP-1872) Use __Host- prefix cookie names to ensure cookies come from the host

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *commented* on IDP-1872 ( https://shibboleth.atlassian.net/browse/IDP-1872?atlOrigin=eyJpIjoiNGExZTI3MDY4YzhkNDA1Y2FlY2I0MmIwNTFmMmM5OTYiLCJwIjoiaiJ9 )

Re: Use __Host- prefix cookie names to ensure cookies come from the host ( https://shibboleth.atlassian.net/browse/IDP-1872?atlOrigin=eyJpIjoiNGExZTI3MDY4YzhkNDA1Y2FlY2I0MmIwNTFmMmM5OTYiLCJwIjoiaiJ9 )

I think what you’re talking about is that somebody else in the domain could contaminate things? I hadn’t really considered that risk factor, but if somebody is set on doing that, there’s nothing we could do to prevent it. The names aren’t a security measure. I agree it could happen but either it’s intentional (and so couldn’t be prevented) or it’s an accident and you’d get them to stop.

I’m not aware of anybody really ever doing this or it ever causing a problem, mostly because domain cookies are fairly rare in practice outside of commercial tracking.

( https://shibboleth.atlassian.net/browse/IDP-1872#add-comment?atlOrigin=eyJpIjoiNGExZTI3MDY4YzhkNDA1Y2FlY2I0MmIwNTFmMmM5OTYiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-1872#add-comment?atlOrigin=eyJpIjoiNGExZTI3MDY4YzhkNDA1Y2FlY2I0MmIwNTFmMmM5OTYiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100183- sha1:51e3c50 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20211022/31d2397c/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-bfda4a89-9487-444d-9cc0-7a3d2c6dfdc1
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211022/31d2397c/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-865dae58-79d7-41c9-94fe-7ef53be96090
Type: image/png
Size: 457 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211022/31d2397c/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-e79ca340-75f9-4cae-bcbd-c096e60266b5
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211022/31d2397c/attachment-0005.png>