title: Are cookies safe in a Heroku app on herokuapp.com?
body: <p>I am developing an app, which I will deploy on Heroku. The app is only used within an <code>iframe</code> on another site, so I don't care about the domain name. I plan to deploy my app on <code>example.herokuapp.com</code> instead of using a custom domain on <code>example.com</code>.</p>
  
  <p>My app uses cookies, and I want to be sure that others cannot manipulate my cookies to protect my app against <a href="http://en.wikipedia.org/wiki/Session_fixation" rel="nofollow">session fixation</a> and similar attacks. If <code>attacker.herokuapp.com</code> is able to set a cookie for <code>herokuapp.com</code>, browsers will not be able to protect me, since <code>herokuapp.com</code> is not a <a href="http://publicsuffix.org/" rel="nofollow">public suffix</a>. See <a href="http://w2spconf.com/2011/papers/session-integrity.pdf" rel="nofollow">http://w2spconf.com/2011/papers/session-integrity.pdf</a> for a detailed description of the issue.</p>
  
  <p>My question is: When browsers can't protect my users, will Heroku do it by blocking cookies for <code>herokuapp.com</code>?</p>