Public suffix list Göran Weinholt (29 Nov 2020 09:03 UTC)
Re: Public suffix list Jakub T. Jankiewicz (29 Nov 2020 09:29 UTC)
Re: Public suffix list Göran Weinholt (29 Nov 2020 09:39 UTC)
Re: Public suffix list Magnus Ahltorp (29 Nov 2020 12:30 UTC)

Public suffix list Göran Weinholt 29 Nov 2020 08:59 UTC

Hello schemers,

Lassi asked me to forward this information here. When you have a domain
that works like a top-level domain (TLD) such as .org or .com you don't
want to allow e.g. mallory.tld to set or read cookies for alice.tld. This
is important for the security of the web sites, as they can otherwise
access each other's user data.

So browers need to know which domain names operate as TLDs. The domain
name is going to be acting in the same way as a TLD, so e.g. will be able to set and read cookies for, unless something is done about this.

Fortunately there is a fix for the problem. Some TLDs already have
sub-domains where all user domains go, like, so browsers can't
just use the heuristic of looking for a single dot. Instead they have a
list of suffixes (like or This is called ths Public
Suffix List.

I recommend that the owner of requests the domain to be added
to the Public Suffix List. The web site is <>.
Having the domain on the list will ensure that browsers deal with it

Göran Weinholt   |
Debian Developer | 73 de SA6CJK