Cross-domain cookie security and migration

2 posts · Apr 2013 – Apr 2015

What this trail covers

This feature thread tracks the evolution of cross-domain cookie security and the migration of GitHub Pages to mitigate related vulnerabilities. Initially, the focus was on addressing phishing and cross-domain cookie vulnerabilities arising from hosting custom user content on subdomains. This post details the migration of GitHub Pages to their own `github.io` domain to mitigate these risks. It also explains the technical details of cookie tossing attacks, including how browsers send cookies, the...

All GitHub trails

Apr 2015Eight lessons learned hacking on GitHub Pages for six monthsThis post details the migration of GitHub Pages to their own `github.io` domain to mitigate cross-domain cookie security risks and phishing vulnerabilities. It explains the technical details of cookie tossing attacks and how browsers send cookies. The post also covers the use of public APIs for Pages infrastructure, the importance of user-initiated breaking changes, descriptive error messages, and optimizing for ideal use cases.
Apr 2013Yummy cookies across domainsThis post details the technical challenges and server-side mitigations for cross-domain cookie vulnerabilities, specifically 'cookie tossing,' 'cookie paths workaround,' 'cookie escaping,' and 'cookie overflow.' It explains how browsers send cookies, the implications of RFC 6265, and the implementation of Rack middleware to drop malicious cookies by inspecting duplicate session cookies, handling path-specific cookies, and addressing URL-encoded cookie names. The post also highlights the limitations of server-side mitigation due to browser cookie overflow limits, which necessitated the migration of GitHub Pages to a dedicated `github.io` domain.
Advertisement