Cookie Domain Test

App config hardcodes Set-Cookie ... Domain=victim.ttx.anthonyaws.com, which is normal for apps that don't dynamically infer their own hostname. Reload this page through each front door:

• If you're on victim.ttx.anthonyaws.com, the browser will send the cookie back on reload → "was received"
• If you're on any other hostname (l7proxy, l4relay, alb-demo, cf-demo), the browser will refuse to send a cookie scoped to a different domain → every request looks like a fresh, unauthenticated session, even though a real login/session cookie was issued. This is what breaks authenticated scan coverage.

Reload this page | Back to dashboard