>>
During testing, I discovered that certain server-side frameworks, such as Django and ASP.NET, apply normalization and trimming to cookie names before processing. Specifically, when the server interprets U+2000 as a whitespace character, it removes it, resulting in a cookie name that becomes equivalent to __Host-name.
<<
https://portswigger.net/research/cookie-chaos-how-to-bypass-host-and-secure-cookie-prefixes

このCookie Chaos、Djangoは脆弱なようだが、Railsは名前が挙がっていないので、違っていそう。

#Cookie #HTTPCookie #HTTPクッキー #クッキー #セキュリティ #情報セキュリティ #Django #Rails