Thinking back to github.blog/2013-04-09-yummy… is a pretty good old write up about just how gross all of this is. It is madness to start..even wilder you can’t tell where your cookies even come from (subdomain set or not).

>even wilder you can’t tell where your cookies >even come from (subdomain set or not) Which was the whole point of __HOST, right?

__Host is definitely a super handy primitive for this area for sure.

I’m really happy to hear that folks are using it. :)

wait .. is it not common? Its pretty high up in my list of simple, solid wins in a web app

😂 - come on now...you know you live in a web security bubble 😛

I was hoping my bubble does cover a big chunk of page loads though

Although, on second thought, I suspect my bubble doesn't cover most cookies. Those are set by a .. different crowd. We just need the EU to mandate __Host. Its the obvious next step for Mike after his w3c leadership

Nominated as head webmaster for all sites.