Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cookie Bomb or Let's Break the Internet

homakov.blogspot.com

Post reply on HN
Print view View original

81–82 of 82 posts

Re: Cookie Bomb or Let's Break the Internet

#81

Post by twic »

homakov wrote: post #22
jffry wrote: post #14

Earlier quoted context omitted.

That would be nice, but it would have a lot of ramifications. Before setting the cookie, the browser would need to know if it's allowed, so presumably it would have to load some file. Perhaps this could be done in a manner similar to CORS requests

Content-Security-Policy: can-set-cookies: no! BTW if JS is of we can use

It might be better to allow:

Content-Security-Policy: can-set-cookies-for-parent-domain: no!

There's no harm in letting haxx0r.blogspot.com set cookies for haxx0r.blogspot.com. It's only cookies for blogspot.com that should be restricted.

Re: Cookie Bomb or Let's Break the Internet

#82

Post by aaronem »

mobweb wrote: post #50
aaronem wrote: post #36

Earlier quoted context omitted.

I've never seen a prompt to open a mailto: link. Where is it specified there should be one?

I think by "interactive prompt" he means "user interaction".

I suppose I can see an argument for popping something up before firing the schema handler when something sets location.href to a mailto: URL, but that seems like the sort of thing where you'd really want to wait for evidence that it's a problem for anyone before you implement it; it both annoys the user and complicates your code, neither of which is desirable in the absence of real provocation.
Post reply on HN