Comment on Cookie Bomb or Let's Break the InternetparentComments−homakov12yContent-Security-Policy: can-set-cookies: no!BTW if JS is of we can use <meta http-equiv Set Cookie>−twic12yIt might be better to allow:Content-Security-Policy: can-set-cookies-for-parent-domain: no!There's no harm in letting haxx0r.blogspot.com set cookies for haxx0r.blogspot.com. It's only cookies for blogspot.com that should be restricted.−jffry12yWell OK then.
Comments
Content-Security-Policy: can-set-cookies: no!
BTW if JS is of we can use <meta http-equiv Set Cookie>
It might be better to allow:
Content-Security-Policy: can-set-cookies-for-parent-domain: no!
There's no harm in letting haxx0r.blogspot.com set cookies for haxx0r.blogspot.com. It's only cookies for blogspot.com that should be restricted.
Well OK then.