⬇ Download holy card: ·
⚔ Commemorated today: The Scourge of the Doubled Bitcoin (2020)Saint Cookie Tossing, Who Threw Biscuits From the Subdomains
Patron of multi-user servers, cookies shared across subdomains, and those who trust the neighbour on the same domain.
Life
In 2024 Thomas Houhou revealed a flaw in JupyterHub (CVE-2024-28233): from a malicious subdomain you could "toss" a cookie at the legitimate application and gain cross-site scripting on the user's session, up to full access to the API and their personal server. Where several services live under neighbouring domains, a cookie thrown from the right spot becomes a key.
Prayer
O Saint Cookie Tossing, who throws biscuits from the domain next door, teach our servers to distrust cookies that arrive from outside. Amen.
How to celebrate
Celebrated by updating JupyterHub to 4.1.0 and carefully separating the domains of services that share their users.
A biscuit thrown by the neighbour is a bitter mouthful for the owner.