Now that you mention it... I looked did a little investigation and it turns out you can't tell where a cookie comes from. document.cookie in javascript just re

Now that you mention it... I looked did a little investigation and it turns out you can't tell where a cookie comes from. document.cookie in javascript just returns a string, and HTTP_COOKIE doesn't have any identifying information. So yes, you're right. I was wrong. You can get poisoned by cookies on a root and there's really nothing you can do about it except hope that your browser is smart enough to make prefer your good.example.com cookies as opposed to the root cookies set by evil.example.com