Cookies are not being set for '.amazonaws.com' in chrome 57 and 58 browsers Cookies are not being set for '.amazonaws.com' in chrome 57 and 58 browsers google-chrome google-chrome

Cookies are not being set for '.amazonaws.com' in chrome 57 and 58 browsers


This behavior seems correct on the part of Chrome.

This WontFix/WorkingAsIntended bug report -- about another (non-AWS) domain -- references this change in Chromium -- which seems, in turn, to correlate with this change to the Public Suffix List... a change which added *.compute-1.amazonaws.com and its peers in other AWS regions to the list.

Previously, compute-1.amazonaws.com was on the list without a wildcard in front.

This change should effectively prevent setting cookies on (e.g.) ec2-203-0-113-0.compute-1.amazonaws.com... which, if you think about it, makes no sense as a practice anyway, because...

ec2-203-0-113-0.compute-1.amazonaws.com is not a hostname in a domain that is yours.

It's just a forward/reverse DNS entry for an IP address that, today, happens to be assigned to you. How long it will be allocated to you may be a short time or a long time, but for all anyone knows, five minutes from now you could stop using it and it could be assigned to someone else, and any browser visiting what they thought was your site would dutifully hand over its cookies to whatever server happens to be listening on that address, tomorrow... potentially creating a neat exploit vector.

If you need to set cookies from your EC2 instances, you should point hostnames from your own domain to those instances.