title: Cross-domain-cookies - a maybe new idea
body: <p>My buddy Carsten Lau came along with an interesting idea on how to read cross-domain-cookies.</p>
  
  <p>Situation: You want to read a cookie from domain "A" that was set on domain "B".
  Idea: From the client on domain "A", you execute a get-request to a dynamic resource on domain "B" – f.e. an image or javascript, which on the server "B" is in fact a programming language capable of reading cookies like PHP, Java etc. With that request, you send an unique identifier like a session id. So the code on the client which looks at a site on domain "A" could look like this:</p>
  
  <pre><code>&lt;img src="www.domainB.com/?getCookie.php?sessionID=1234"&gt;
  </code></pre>
  
  <p>Now comes the funny part, server B reads on server-side the cookie set by domain "B" and writes the result with the provided session-id either in a DB accessible by domain "A" or returns a response which contains the cookie information to the client on domain "A" which then sends it via AJAX to server "A".</p>
  
  <p>I am pretty sure there is a flaw we didn't find yet. I personally believe server "B" will not be able to read cookie informations because the client-browsers URL points to domain "A", but of course the "getCookie"-request explained above points to "B".</p>
  
  <p>Please tell us what you think about it, why it works or why it can't work. A small proof of concept was, to my big surprise, successful.</p>