cookie.c.e.0.b.0.7.4.0.1.0.0.2.ip6.arpa

A simple demo showing how gaps in the Public Suffix List allow globally accessible cookies on ip6.arpa domains.

Seal 
Waiting to set cookie...
This demo highlights an oddity in how the Public Suffix List treats ip6.arpa.
Since 2.ip6.arpa is the only publicly routed reverse zone, cookies scoped here are effectively global, something normally blocked on TLDs like .com.
In practice this isn’t a security issue, since nobody sane runs normal websites directly on .ip6.arpa.

More info: elliott.diy/blog/arpa • GitHub • lemonyte.com