-
Notifications
You must be signed in to change notification settings - Fork 22.9k
Open
Labels
Description
MDN URL
https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#domaindomain-value
What specific section or headline is this issue about?
Domain=
What information was incorrect, unhelpful, or incomplete?
The sentence
If omitted, this attribute defaults to
the host of the current document URL,
not including subdomains.
could be improved.
A reader could assume that sending a cookie from a.example.com would also be valid for example.com, because example.com is a URL not including subdomains.
However, a cookie sent from a.example.com is only valid for that particular domain, neither aa.a.example.com, nor b.example.com, nor example.com.
What did you expect to see?
If omitted, this attribute defaults to
the host of the current document URL.
(This is more restrictive than sending the host name,
as subdomains of the host are not included.)
Do you have any supporting links, references, or citations?
Reference:
https://datatracker.ietf.org/doc/html/rfc6265#page-20
If the server omits the Domain attribute, the user
agent will return the cookie only to the origin server.
And tests in Chrome, Firefox, Safari.
Do you have anything more you want to share?
No response