7 ms·

www is more secure to use than the root domain because of how cookies are set. Setting a cookie for the www subdomain ensures that it’s only available for that

www is more secure to use than the root domain because of how cookies are set. Setting a cookie for the www subdomain ensures that it’s only available for that subdomain and not globally across all subdomains. It makes sense that sites that use www are generally more secure.

robocat 7y ago
Note that by default Google analytics puts the cookies on the root domain, and you need to change the JavaScript snippet to avoid that. Cloudflare also puts cookies on the root domain. I definitely agree though.
numlock86 7y ago
> www is more secure to use than the root domain because of how cookies are set. > Setting a cookie for the www subdomain ensures that it’s only available for that subdomain and not globally across all subdomains. No, www is not more secure because of cookies. As you said, it depends on how cookies are set, which is up to the host, as this is defined in the HTTP headers coming from the server. It's possible to access a cookie from "www.example.com" on "example.com" or "sub.example.com" if it's configured like that on the backend. Also the browser needs to comply. (Protip: most browsers do)
- snowwrestler 7y ago
  > It's possible to access a cookie from "www.example.com" on "example.com" or "sub.example.com" if it's configured like that on the backend. Ok but to my knowledge it is impossible to set a cookie on example.com and make it inaccessible to subdomain.example.com.
  - type0 7y ago
    It's not a bug, it's a feature /s
  - megous 7y ago
    That's not true at all. Try document.cookie = 'a=b' in a browser console on non-www domain and then do document.cookie on the www variant. You'll see it not set. (The cookie will only be accessible on subdomains if you include the domain explicitly, like document.cookie = 'a=b;domain=toplevel.domain')
    - Jwarder 7y ago
      My understanding that doesn't work on old versions of IE.
      - will4274 7y ago
        Yeah, because the WHATWG folks changed the spec after 20 years. Not because IE implemented the wrong thing. Not surprising folks in this thread remember the old spec, which was valid for longer.
      - megous 7y ago
        True, not even IE11.
megous 7y ago
You can set cookies in a way that they are only accessible on the top domain.

robocat 7y ago

Note that by default Google analytics puts the cookies on the root domain, and you need to change the JavaScript snippet to avoid that. Cloudflare also puts cookies on the root domain. I definitely agree though.

numlock86 7y ago

> www is more secure to use than the root domain because of how cookies are set. > Setting a cookie for the www subdomain ensures that it’s only available for that subdomain and not globally across all subdomains. No, www is not more secure because of cookies. As you said, it depends on how cookies are set, which is up to the host, as this is defined in the HTTP headers coming from the server. It's possible to access a cookie from "www.example.com" on "example.com" or "sub.example.com" if it's configured like that on the backend. Also the browser needs to comply. (Protip: most browsers do)

snowwrestler 7y ago
> It's possible to access a cookie from "www.example.com" on "example.com" or "sub.example.com" if it's configured like that on the backend. Ok but to my knowledge it is impossible to set a cookie on example.com and make it inaccessible to subdomain.example.com.
- type0 7y ago
  It's not a bug, it's a feature /s
- megous 7y ago
  That's not true at all. Try document.cookie = 'a=b' in a browser console on non-www domain and then do document.cookie on the www variant. You'll see it not set. (The cookie will only be accessible on subdomains if you include the domain explicitly, like document.cookie = 'a=b;domain=toplevel.domain')
  - Jwarder 7y ago
    My understanding that doesn't work on old versions of IE.
    - will4274 7y ago
      Yeah, because the WHATWG folks changed the spec after 20 years. Not because IE implemented the wrong thing. Not surprising folks in this thread remember the old spec, which was valid for longer.
    - megous 7y ago
      True, not even IE11.

megous 7y ago

You can set cookies in a way that they are only accessible on the top domain.