3 ms·

Isn't that what the domain portion of the set-cookie header is for?

• seabee 16y ago
  It gets propagated to subdomains, it doesn't restrict it to just the domain specified.
  • apgwoz 16y ago
    Yes, it gets propogated to subdomains, but the point was that if you have subdomain X.y.z, as long as you set the cookie for y.z, the cookie is valid for X.y.z and U.y.z.
    • storborg 16y ago
      My point was that you don't want the cookie to be sent to other subdomains, so you'd actually want to set the domain to X.y.z. You can't do that if you're web domain is y.z.