title: How come one web site can pickup cookies from another web site
body: <p>I noticed something funny while using Fiddler to debug a cookie issue we are having.  If the cookie path value is just the beginning of another site’s path value then the second site sees the first site’s cookies.</p>
  
  <p>This is easier to show than to describe.</p>
  
  <p>I created a simple site with the following ASPX code</p>
  
  <pre><code>&lt;div&gt;
      Cookie Value &lt;asp:Label ID="lblTest" runat="server"&gt;&lt;/asp:Label&gt;&lt;br /&gt;
      See Foo &lt;asp:Label ID="lblSeeFoo" runat="server"&gt;&lt;/asp:Label&gt;&lt;br /&gt;
      See Foobar &lt;asp:Label ID="lblSeeFoobar" runat="server"&gt;&lt;/asp:Label&gt;&lt;br /&gt;
      See Foonot &lt;asp:Label ID="lblSeeFoonot" runat="server"&gt;&lt;/asp:Label&gt;
  &lt;/div&gt;
  </code></pre>
  
  <p>In the code behind I create a cookie with a path based on ApplicationPath.    The created cookie name includes the ApplicationPath name to make it easy to see in Fiddler.  This code also looks for cookies from three specific web sites.</p>
  
  <pre><code>Protected Sub Page_Load(sender As Object, e As EventArgs) Handles Me.Load
      Dim CookieName As String = "Test " + Me.Request.ApplicationPath.Replace("/"c, "")
      Dim myCookie As HttpCookie = Me.Request.Cookies(CookieName)
      If (myCookie Is Nothing) Then
  
          myCookie = New HttpCookie(CookieName)
          myCookie.Path = Me.Request.ApplicationPath
          myCookie.Expires = DateTime.Now.AddDays(1)
          myCookie.Value = DateTime.Now.ToString()
          Response.Cookies.Add(myCookie)
      End If
      Me.lblTest.Text = myCookie.Value
  
      Dim TestCookie As HttpCookie
      TestCookie = Me.Request.Cookies("Test Foobar")
      Me.lblSeeFoobar.Text = CStr(TestCookie IsNot Nothing)
      TestCookie = Me.Request.Cookies("Test Foonot")
      Me.lblSeeFoonot.Text = CStr(TestCookie IsNot Nothing)
      TestCookie = Me.Request.Cookies("Test Foo")
      Me.lblSeeFoo.Text = CStr(TestCookie IsNot Nothing)
  End Sub
  </code></pre>
  
  <p>This application is then published to three web sites named Foo, Foobar and Foonot.</p>
  
  <p>Viewing each site shows that Foobar and Foonot can see the cookie for Foo.</p>
  
  <p>Here is Foobar’s result</p>
  
  <pre><code>Cookie Value 7/3/2014 10:40:01 AM
  See Foo True
  See Foobar True
  See Foonot False
  </code></pre>
  
  <p>Foobar can read Foo’s cookies.  Foonot can also see Foo's cookies.  Foonot and Foobar do not see each other's cookies.</p>
  
  <p>Here is the raw header information from Fiddler:</p>
  
  <pre><code>GET /Foobar/ HTTP/1.1
  Accept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif, image/pjpeg, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
  Accept-Language: en-US
  User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
  Accept-Encoding: gzip, deflate
  Connection: Keep-Alive
  Host: webdev
  Cookie: Test Foobar=7/3/2014 10:40:01 AM; Test Foo=7/3/2014 10:39:43 AM
  </code></pre>
  
  <p>I tried searching for information on this issue but couldn’t come up with anything.</p>
  
  <p>Is this a known thing?</p>
  
  <p>Is there a way to prevent this?</p>
  
  <p>Isn’t this a big security issue?  In a shared hosting environment couldn’t I create a domain name that is longer that an existing one and pickup their cookies?</p>