Hacker News Reader

Whether they’re malicious or not, I don’t want to send them the session cookie for an unrelated website.

So scope cookies to the SSL certificate instead of the domain name, or simply offer to clear them for a domain whenever you bypass the HSTS on one.

> So scope cookies to the SSL certificate

And invalidate every user's session whenever the server's certificate is renewed??

> But I've never seen a captive portal using fake certificates either.

I never seen a captive portal using a valid certificate either. Not like I saw many captive portals (last time was like... 2018?) but still.

>using fake certificates

What's the definition of a fake certificate? Self signed? Signed by a real CA, but for a different domain (the captive portal operator's generally)?