Comment on Cookie Bomb or Let's Break the InternetparentComments−jffry12yThat would be nice, but it would have a lot of ramifications. Before setting the cookie, the browser would need to know if it's allowed, so presumably it would have to load some file. Perhaps this could be done in a manner similar to CORS requests−homakov12yContent-Security-Policy: can-set-cookies: no!BTW if JS is of we can use <meta http-equiv Set Cookie>−twic12yIt might be better to allow:Content-Security-Policy: can-set-cookies-for-parent-domain: no!There's no harm in letting haxx0r.blogspot.com set cookies for haxx0r.blogspot.com. It's only cookies for blogspot.com that should be restricted.−jffry12yWell OK then.
Comments
That would be nice, but it would have a lot of ramifications. Before setting the cookie, the browser would need to know if it's allowed, so presumably it would have to load some file. Perhaps this could be done in a manner similar to CORS requests
Content-Security-Policy: can-set-cookies: no!
BTW if JS is of we can use <meta http-equiv Set Cookie>
It might be better to allow:
Content-Security-Policy: can-set-cookies-for-parent-domain: no!
There's no harm in letting haxx0r.blogspot.com set cookies for haxx0r.blogspot.com. It's only cookies for blogspot.com that should be restricted.
Well OK then.