Skip to content

Set-Cookie without Domain attribute #41646

@mhchem

Description

@mhchem

MDN URL

https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#domaindomain-value

What specific section or headline is this issue about?

Domain=

What information was incorrect, unhelpful, or incomplete?

The sentence

If omitted, this attribute defaults to
the host of the current document URL,
not including subdomains.

could be improved.

A reader could assume that sending a cookie from a.example.com would also be valid for example.com, because example.com is a URL not including subdomains.

However, a cookie sent from a.example.com is only valid for that particular domain, neither aa.a.example.com, nor b.example.com, nor example.com.

What did you expect to see?

If omitted, this attribute defaults to
the host of the current document URL.
(This is more restrictive than sending the host name,
as subdomains of the host are not included.)

Do you have any supporting links, references, or citations?

Reference:
https://datatracker.ietf.org/doc/html/rfc6265#page-20

If the server omits the Domain attribute, the user
agent will return the cookie only to the origin server.

And tests in Chrome, Firefox, Safari.

Do you have anything more you want to share?

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions