Hacker News Reader

Comment by mkagenius | Hacker News Reader

Were cookies shared across sites in 2008? It seems pretty odd..

Images are loaded with the cookies of their own site. Example: go to google.com, then open the console and type the following:

var i = document.createElement('img');

i.src= "http://news.ycombinator.com/y18.gif";

Then look at the cookies sent over the network.

I just tried it using Chrome 57:

    var i = document.createElement('img');
    i.src= "https://news.ycombinator.com/y18.gif";
    document.body.insertBefore(i, document.body.firstChild);

The image appeared in the upper left of the Google home page.

So, I clicked over to the Network tab and viewed the headers. The request headers do not include any cookies. If Hacker News were a broker using GET requests to buy shares, and the image URL was such a request, HN would not have known whose account to buy the shares for, even though I'm logged in in another tab.

So, presumably, the hack does not work in Chrome 57.

Edit: Never mind. It's because I have third-party cookies blocked. If I unblock third-party cookies, my HN cookie does get sent.

Imho this is a complete misfeature of the web. It facilitates invasive tracking in exchange for very marginal utility.

This is how FB & others track everyone on the web through ad frames, like buttons, etc.

Just FYI, I use the uBlock Origin extension for Chrome and I believe it solves all this for me.

Do they get info about from which page they got requested when one includes just an image?

Yes, it is passed along through the Referer (sic) header.

Yes, via the HTTP Referer header.

Where do I type it ?

In Firefox, Ctrl+Shift+K opens the web console.

Ctrl + Shift + J

in chrome

Cookies are still sent for requests in which the response is opaque to the current document/window (e.g. <img>, <video>, <audio>, <script>, etc). There's no way for the document/window containing these elements to ever access the actual bytes returned by them.

Because most people don't have 3rd party cookies disabled. It's one of the first things you should do when you install a browser. It doesn't break anything worthwhile and protects your privacy (and security).

This is still true in 2017, unless a website is using same site cookies, which is a very recent thing. (The first draft is from 2015 April)

That's how the web works today as well. That's why you need CSRF protection.

Reply on news.ycombinator.com