Yummy cookies across domains

This post details the technical challenges and server-side mitigations for cross-domain cookie vulnerabilities, specifically 'cookie tossing,' 'cookie paths workaround,' 'cookie escaping,' and 'cookie overflow.' It explains how browsers send cookies, the implications of RFC 6265, and the implementation of Rack middleware to drop malicious cookies by inspecting duplicate session cookies, handling path-specific cookies, and addressing URL-encoded cookie names. The post also highlights the limitations of server-side mitigation due to browser cookie overflow limits, which necessitated the migration of GitHub Pages to a dedicated `github.io` domain.