Are cookies safe in a Heroku app on herokuapp.com?
cookies, cross-domain, heroku
Solution
Just wanted to post an update for anyone who ran across this question as I did. I was working on a similar problem, except that I wanted to purposefully allow access to the same cookie from two different heroku apps.
"herokuapp.com" and "herokussl.com" are now on the Public Suffix List, so your cookies should be safe if they are set for one of those domains. I ended up having to use custom domains in order to share cookies across both apps.
Heroku also released an article on the topic: https://devcenter.heroku.com/articles/cookies-and-herokuapp-com
Problem
I am developing an app, which I will deploy on Heroku. The app is only used within an `iframe` on another site, so I don't care about the domain name. I plan to deploy my app on `example.herokuapp.com` instead of using a custom domain on `example.com`. My app uses cookies, and I want to be sure that others cannot manipulate my cookies to protect my app against session fixation and similar attacks. If `attacker.herokuapp.com` is able to set a cookie for `herokuapp.com`, browsers will not be able to protect me, since `herokuapp.com` is not a public suffix. See http://w2spconf.com/2011/papers/session-integrity.pdf for a detailed description of the issue. My question is: When browsers can't protect my users, will Heroku do it by blocking cookies for `herokuapp.com`?