search

w3c / webappsec-suborigins

Suborigins
https://w3c.github.io/webappsec-suborigins/
Other
25 stars 9 forks source link

Suborigin cookies should not be treated as third-party #43

Open devd opened 8 years ago

devd commented 8 years ago

Not sure if this is something we have already mentioned in the spec, but since suborigins are hosted on the same website, it isn't a third party and shouldn't be treated as such by the cookie code.

joelweinberger commented 8 years ago

I think this is more or less handled by the spec for free (or at least, in my mind it will be), but we should definitely verify that and make sure of it.

annevk commented 7 years ago

This would fall out of Fetch, which includes cookies based on the request URL (and some policies).