Sending session tokens to every subdomain, and also potentially leaking other sensitive data, is a pretty strong case in my opinion. Of course, this isn't some

Sending session tokens to every subdomain, and also potentially leaking other sensitive data, is a pretty strong case in my opinion. Of course, this isn't something that has a concrete right and wrong answer. It's more a question of how much you trust your subdomains. Personally, I think sharing that information should be a conscious choice when setting the cookies and not something that you let happen by default.