[JIRA] (IDP-1872) Use __Host- prefix cookie names to ensure cookies come from the host

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *commented* on IDP-1872 ( https://shibboleth.atlassian.net/browse/IDP-1872?atlOrigin=eyJpIjoiZTFjZDM0M2VlNWVkNDNmMmI5MDgyNzE4NWRmOWQyODUiLCJwIjoiaiJ9 )

Re: Use __Host- prefix cookie names to ensure cookies come from the host ( https://shibboleth.atlassian.net/browse/IDP-1872?atlOrigin=eyJpIjoiZTFjZDM0M2VlNWVkNDNmMmI5MDgyNzE4NWRmOWQyODUiLCJwIjoiaiJ9 )

Maybe you could clarify…is this an actual security feature? I assumed by “Host-” or whatever, you meant “use something derived from the vhost name”, but I’m wondering if you mean there’s some new hacky trick somebody came up with that the browsers support to actually keep trying to secure these things? That would be insane and laughable, but somehow totally believable.

( https://shibboleth.atlassian.net/browse/IDP-1872#add-comment?atlOrigin=eyJpIjoiZTFjZDM0M2VlNWVkNDNmMmI5MDgyNzE4NWRmOWQyODUiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-1872#add-comment?atlOrigin=eyJpIjoiZTFjZDM0M2VlNWVkNDNmMmI5MDgyNzE4NWRmOWQyODUiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100183- sha1:51e3c50 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20211022/d3c2d3d5/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-d5a33c32-c203-4daa-9295-f32f7e8d9d4c
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211022/d3c2d3d5/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-7ccca1ea-a793-408b-8b39-1afecb4a7aa5
Type: image/png
Size: 457 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211022/d3c2d3d5/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-7a3eb802-47bc-4e9f-ab83-06ee6f2991fc
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211022/d3c2d3d5/attachment-0005.png>