// GLOSSARY

Cookie Tossing and Shadowing

Setting a domain-wide cookie from a controlled subdomain to overwrite the application's own value (fixation) or to have a second cookie with the same name delivered alongside it (shadowing). The crux is that the HTTP protocol does not firmly define which of several same-named cookies is chosen; the parser on the server side makes this decision by its own rule, and these rules differ across server software. The attacker exploits this ambiguity: while the application processes the value it believes is 'correct', it is in fact processing the one the attacker planted. Session fixation, session confusion or authorization bypass can follow from here. It grows stronger combined with the related-domain attacker position (compromise of a subdomain sharing the same eTLD+1); the most robust defense is using the __Host- prefix on critical cookies.