3 ms·
I use www. for everything because of cookies, when having cookies on the plain domain they are on every subdomain automatically, while having them on www. is ex
by nik736 7y ago
I use www. for everything because of cookies, when having cookies on the plain domain they are on every subdomain automatically, while having them on www. is exclusively for www.
- numlock86 7y agoI like your idea but it's based on false assumptions. See RFC6265. Depending on the implementation on the backend side (specifically the "Set-Cookie" header) it's possible to handle a cookie generated on "www.example.com" on "example.com" or "sub.example.com" ... and all other possible combinations. [1] https://tools.ietf.org/html/rfc6265 https://tools.ietf.org/html/rfc6265
- g105b 7y agoWith the correct configuration, www.example.com cookies do not leak over all subdomains, but it's impossible to configure example.com cookies to _not_ leak over all subdomains.
- colinsidoti 7y agoIf you omit the domain it shouldn't leak, though as with many things web it's browser-specific: https://en.wikipedia.org/wiki/HTTP_cookie#Domain_and_path https://en.wikipedia.org/wiki/HTTP_cookie#Domain_and_path