How come one web site can pickup cookies from another web site - asp.net

Question

I noticed something funny while using Fiddler to debug a cookie issue we are having. If the cookie path value is just the beginning of another site’s path value then the second site sees the first site’s cookies.
This is easier to show than to describe.
I created a simple site with the following ASPX code
<div>
Cookie Value <asp:Label ID="lblTest" runat="server"></asp:Label><br />
See Foo <asp:Label ID="lblSeeFoo" runat="server"></asp:Label><br />
See Foobar <asp:Label ID="lblSeeFoobar" runat="server"></asp:Label><br />
See Foonot <asp:Label ID="lblSeeFoonot" runat="server"></asp:Label>
</div>
In the code behind I create a cookie with a path based on ApplicationPath. The created cookie name includes the ApplicationPath name to make it easy to see in Fiddler. This code also looks for cookies from three specific web sites.
Protected Sub Page_Load(sender As Object, e As EventArgs) Handles Me.Load
Dim CookieName As String = "Test " + Me.Request.ApplicationPath.Replace("/"c, "")
Dim myCookie As HttpCookie = Me.Request.Cookies(CookieName)
If (myCookie Is Nothing) Then
myCookie = New HttpCookie(CookieName)
myCookie.Path = Me.Request.ApplicationPath
myCookie.Expires = DateTime.Now.AddDays(1)
myCookie.Value = DateTime.Now.ToString()
Response.Cookies.Add(myCookie)
End If
Me.lblTest.Text = myCookie.Value
Dim TestCookie As HttpCookie
TestCookie = Me.Request.Cookies("Test Foobar")
Me.lblSeeFoobar.Text = CStr(TestCookie IsNot Nothing)
TestCookie = Me.Request.Cookies("Test Foonot")
Me.lblSeeFoonot.Text = CStr(TestCookie IsNot Nothing)
TestCookie = Me.Request.Cookies("Test Foo")
Me.lblSeeFoo.Text = CStr(TestCookie IsNot Nothing)
End Sub
This application is then published to three web sites named Foo, Foobar and Foonot.
Viewing each site shows that Foobar and Foonot can see the cookie for Foo.
Here is Foobar’s result
Cookie Value 7/3/2014 10:40:01 AM
See Foo True
See Foobar True
See Foonot False
Foobar can read Foo’s cookies. Foonot can also see Foo's cookies. Foonot and Foobar do not see each other's cookies.
Here is the raw header information from Fiddler:
GET /Foobar/ HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif, image/pjpeg, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: en-US
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Accept-Encoding: gzip, deflate
Connection: Keep-Alive
Host: webdev
Cookie: Test Foobar=7/3/2014 10:40:01 AM; Test Foo=7/3/2014 10:39:43 AM
I tried searching for information on this issue but couldn’t come up with anything.
Is this a known thing?
Is there a way to prevent this?
Isn’t this a big security issue? In a shared hosting environment couldn’t I create a domain name that is longer that an existing one and pickup their cookies?

Answer 1

I'm not sure what the actual URL of Foo, Foobar and Foonot.
However, a cookie can be shared among multiple subdomains.
For example, IE10 shares the cookie among the following sites -
mysite.com
Foo.mysite.com
Foobar.mysite.com
Foono.mysite.com
If you want cookie to be available in the specific domain only, you can set the cookie's Domain property.
myCookie.Domain = "Foo.mysite.com";

Answer 2

When determining if a cookie is included in the request the cookie path is not examined as a ‘path’ but simply as a string value.
If it was processed as a path then the fact that one site happens to begin with the same text as another would not result in a match. MyDomain.com/Foo is a different web site than MyDomain.com/Foobar. I see it as a different site, IIS serves it up as a different web site, but the browser sees them as the same path as far as the cookies are concerned. The browser is simply doing a string compare on the path values and “/Foo” is the beginning of “/Foobar” so the browser includes those cookies.
Normally this is used so the cookies for a parent web site are available to the child we sites. If there is a site named “Parent” and a nested site named “Child” then the parent’s cookies with a path of “/Parent” would be available to the child site. The child’s cookies with a path of “/Parent/Child” would not be available to the parent. The situation I came across is that a site can pick up the cookies for one if its siblings when the sibling’s path is the start of that site’s path.
I suspect that this string comparison is the one that causes the cookie paths to be case sensitive.
So the answers to my questions are:
Is this a known thing?
Yes. The browser is doing a simple string comparison on the cookie’s path to determine if it should include the cookie in the request.
Is there a way to prevent this?
Yes. Append a slash to the end of the path. “/Foo/” is no longer a subset of “/Foobar/”
myCookie.Path = Me.Request.ApplicationPath + "/"
Isn’t this a big security issue? In a shared hosting environment couldn’t I create a domain name that is longer that an existing one and pickup their cookies?
No. As #the_lotus points out, the domains would be different. The paths only have an effect within a domain. I was only thinking of the paths and didn’t consider the domains.