Alice's Yummy Pizza

When you clicked Sign in, the app responded with two Set-Cookie headers:

Set-Cookie: session=b7d91c; Domain=ngrok.pizza

Set-Cookie: yummy_session=b7d91c

What happened?

• The first cookie tried to apply itself across all of ngrok.pizza; your browser sent it back.
• The second cookie was scoped only to yummy.ngrok.pizza; your browser sent it back.

That's working exactly as intended. Yummy shouldn't be allowed to set a cookie across all of ngrok.pizza, and your browser, with the help of the Public Suffix List, rejected it.

You can also prove it in your browser.

• In Chrome, open DevTools, select Application, then under Storage, expand Cookies and select yummy.ngrok.pizza.
• In Firefox, open Web Developer Tools, select Storage, then expand Cookies and select yummy.ngrok.pizza.

You'll see yummy_session, but no session.

Now, it's time to head over to scrumptious.ngrok.pizza → for even more proof.