4 ms·
> www is more secure to use than the root domain because of how cookies are set. > Setting a cookie for the www subdomain ensures that it’s only available for
by numlock86 7y ago
> www is more secure to use than the root domain because of how cookies are set.
> Setting a cookie for the www subdomain ensures that it’s only available for that subdomain and not globally across all subdomains.
No, www is not more secure because of cookies. As you said, it depends on how cookies are set, which is up to the host, as this is defined in the HTTP headers coming from the server. It's possible to access a cookie from "www.example.com" on "example.com" or "sub.example.com" if it's configured like that on the backend. Also the browser needs to comply. (Protip: most browsers do)
- snowwrestler 7y ago> It's possible to access a cookie from "www.example.com" on "example.com" or "sub.example.com" if it's configured like that on the backend. Ok but to my knowledge it is impossible to set a cookie on example.com and make it inaccessible to subdomain.example.com.
- type0 7y agoIt's not a bug, it's a feature /s
- megous 7y agoThat's not true at all. Try document.cookie = 'a=b' in a browser console on non-www domain and then do document.cookie on the www variant. You'll see it not set. (The cookie will only be accessible on subdomains if you include the domain explicitly, like document.cookie = 'a=b;domain=toplevel.domain')
- Jwarder 7y agoMy understanding that doesn't work on old versions of IE.