List: websecurity@lists.webappsec.org
From: Arian J. Evans
Re: [WEB SECURITY] CSRF protection: What are the benefits of using the Synchronizer Token Pattern if your application is not vulnerable to XSS and using HTTPS only?
Sun, Apr 24, 2011 12:46 AM
On Sat, Apr 23, 2011 at 4:07 PM, Michal Zalewski wrote:
> It can also cause problems for domains that host multiple web
> applications compartmentalized on a host-level, because
> fuzzy-bunnies.example.com can then compromise the XSRF token of
> payments.example.com, even if payments.example.com uses a completely
> separate login cookie