Subject: [httpwg/http-extensions] Support includeSubdomains in Expect-CT (#420)

From: HTTP issue updates <[email-masked]>
Date: Fri, 17 Nov 2017 16:41:38 +0000 (UTC)

It would provide immense security value and ease of deployment.

Cookies are sent across all sub domains; so if example.com has auth cookies, a malicious actor can compromise a CA and create a "$random.example.com" cert and serve it to get a user's cookies. Since example.com never knew about nor had ever served $random.example.com, the UA won't enforce CT requirement on this domain. This would mean a cert that's not on a CT log would work fine to get the user's cookies.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/420