Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

As far as I know, one can set a cookie for example.com and not .example.com and then the cookie will only be visible on example.com and not sub.example.com. Is this true? I have set a cookie on a test domain I own, and it seems that cookies are not shared at static.mydomain.com

This page suggests otherwise:

Omitting www leaves you no choice but to write cookies to *.example.org, so for performance reasons it's best to use the www subdomain and write the cookies to that subdomain.

share|improve this question
add comment

2 Answers 2

up vote 1 down vote accepted

The cookie specification indicates that you are correct:

A is a FQDN string and has the form NB, where N is a non-empty name string, B has the form .B', and B' is a FQDN string. (So, x.y.com domain-matches .y.com but not y.com.)

Even if you do use www.example.com for your site, you still probably want to set some cookies to *.example.com so that they can also be read on a subdomain like blog.example.com.

share|improve this answer
    
I think the confusion stems from the fact that if you do use Google Analytics, it sets cookies on .example.com instead of example.com and your subdomains (static.example.com) cannot be cookieless. If you don't use any such 3rd party though, as long as you don't set cookie on .example.com, you can have a cookieless static domain. –  ustun Dec 6 '13 at 16:53
add comment

In response to the Yahoo Developer page, they are talking about you serving content on your site from www.example.com, but explicitly setting the domain of the cookie - in which case you have to set the cookie as either .example.com or .www.example.com.

When you set a cookie, you have two options:

  1. Do not specify the domain name - in which case the cookie will default to the "Request-Host" (without a dot at the beginning) - in your case www.example.com or example.com (note the embedded dot).
  2. Specify a URL, in which case you fall under the rule "An explicitly specified domain must always start with a dot."

What the Yahoo page is stating is that if you've already issued cookies to .example.com then those cookies will also be sent to subdomain.example.com as well, so if you want to serve your static content on a "cookieless domain" you'd have to use a different URL.

share|improve this answer
    
OK, it finally makes sense, thank you. –  ustun Dec 20 '13 at 10:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.