Question

Describe the mechanism used by a web application to prevent its session cookies from being used by another web application from a different company.

Answer 1

A properly designed browser will not allow a website to access another website's cookies, as this would violate the cross-domain policy and be a major security issue.

Unrelated websites can implement scripts which send information to a single ad tracking network, which can then serve up customized advertisements to these participating websites based on your reported activity.

This is defended against using the same origin policy, which generally prevents one site reading anothers cookies.

When you see behaviour where adverts seem to know where you've been it's likely due to 3rd party ad tracking cookies.

So as a simplified example if you go to site A which uses an ad network, that ad network can record that you were on that site by placing a tracking cookie on your PC.

Then when you go to Site B which uses the same ad network, the ad network reads the cookie that was set when you were on Site A (which it can do 'cause it's loading content from it's domains in both cases so it doesn't break same origin) and can then offer you adverts based on your browsing habits.