If I have 2 domains a.example.org and b.example.org sharing a wildcard certificate for *.example.org, then sometimes visiting one of them will actually proxy to the other one.
eg:
In chrome if I open a new incognito window and visit a.example.org then b.example.org I will see the content for a in both tabs.
If I close all the incognito windows, and try again and open a new incognito window and visit b.example.org then a.example.org I will see the content for b in both tabs.
Connections that are made to an origin server, either directly or
through a tunnel created using the CONNECT method (Section 8.3), MAY
be reused for requests with multiple different URI authority
components. A connection can be reused as long as the origin server
is authoritative (Section 10.1). For TCP connections without TLS,
this depends on the host having resolved to the same IP address.
If I have 2 domains
a.example.org
andb.example.org
sharing a wildcard certificate for*.example.org
, then sometimes visiting one of them will actually proxy to the other one.eg:
In chrome if I open a new incognito window and visit
a.example.org
thenb.example.org
I will see the content fora
in both tabs.If I close all the incognito windows, and try again and open a new incognito window and visit
b.example.org
thena.example.org
I will see the content forb
in both tabs.This looks to be related to HTTP/2 connection reuse