http - Share cookie between subdomain and domain -
i have 2 questions. understand if specify domain .mydomain.com
(with leading dot) in cookie subdomains can share cookie.
can subdomain.mydomain.com
access cookie created in mydomain.com
(without www
subdomain)?
can mydomain.com
(without www
subdomain) access cookie if created in subdomain.mydomain.com
?
the 2 domains mydomain.com
, subdomain.mydomain.com
can share cookies if domain explicitly named in set-cookie
header. otherwise, scope of cookie restricted request host. (this referred "host-only cookie". see what host cookie?)
for instance, if sent following header subdomain.mydomain.com
:
set-cookie: name=value
then cookie won't sent requests mydomain.com
. if use following, usable on both domains:
set-cookie: name=value; domain=mydomain.com
in rfc 2109, domain without leading dot meant not used on subdomains, , leading dot (.mydomain.com
) allow used across subdomains.
however, modern browsers respect newer specification rfc 6265, , ignore leading dot, meaning can use cookie on subdomains top-level domain.
in summary, if set cookie second example above mydomain.com
, accessible subdomain.mydomain.com
, , vice versa.
see also:
Comments
Post a Comment