3 ms·
Re: "... only true for cookies that are not set as 'HostOnly'" Technically, you're right -- but that implies a commitment to vigilance in setting that attribut
by chrisweekly 7y ago
Re: "... only true for cookies that are not set as 'HostOnly'"
Technically, you're right -- but that implies a commitment to vigilance in setting that attribute on every instance of every cookie across every page or endpoint on your apex domain. Further, if you ever want to support some use of a subdomain, you have to deal with the ability of any page therein to set cookies on ".example.com". And when you inevitably miss any instance of any of these, you're unlikely to notice, because everything will still function normally. So in practice, using the apex paints you into a corner and makes the domain less useful.
There's also the issue of DDOS attacks and related problems, for which the fastest and simplest mitigation is updating DNS entries for your CNAME(s). Why take that option off the table?