http - Share cookie between subdomain and domain -


i have 2 questions. understand if specify domain .mydomain.com (with leading dot) in cookie subdomains can share cookie.

can subdomain.mydomain.com access cookie created in mydomain.com (without www subdomain)?

can mydomain.com (without www subdomain) access cookie if created in subdomain.mydomain.com?

the 2 domains mydomain.com , subdomain.mydomain.com can share cookies if domain explicitly named in set-cookie header. otherwise, scope of cookie restricted request host. (this referred "host-only cookie". see what host cookie?)

for instance, if sent following header subdomain.mydomain.com:

set-cookie: name=value 

then cookie won't sent requests mydomain.com. if use following, usable on both domains:

set-cookie: name=value; domain=mydomain.com 

in rfc 2109, domain without leading dot meant not used on subdomains, , leading dot (.mydomain.com) allow used across subdomains.

however, modern browsers respect newer specification rfc 6265, , ignore leading dot, meaning can use cookie on subdomains top-level domain.

in summary, if set cookie second example above mydomain.com, accessible subdomain.mydomain.com, , vice versa.

see also:


Comments

Popular posts from this blog

Spring Boot + JPA + Hibernate: Unable to locate persister -

go - Golang: panic: runtime error: invalid memory address or nil pointer dereference using bufio.Scanner -

c - double free or corruption (fasttop) -