Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

So let's say I have a site at example.com.

I would like to setup another site at example.com/somewhere else.

Can Ngnix be configured so these sites are not connected in anyway? Meaning, a session variable started on /somewhere can't be seen on example.com?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

Although I presume it's valid to ask how nginx can help here, this matter is ultimately influenced by the web-browser, too, and is outside of nginx' domain.

There is no way to prevent an app at example.com/somewhere from setting cookies for example.com/. Sure, you could potentially block certain Set-Cookie directives through nginx or another web-server, but the app could still use JavaScript for setting such cookies.

Using distinct domain names is the only way to achieve separation between the two apps. See http://security.stackexchange.com/questions/15939/does-setting-the-cookie-path-protect-me-from-xss-from-another-context/32698#32698.

share|improve this answer
    
Thannks for the info! –  extreme Mar 21 '13 at 2:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.