Can subdomain.example.com set a cookie that can be read by example.com?

Question

I simply cannot believe this is quite so hard to determine.

Even having read the RFCs, it's not clear to me if a server at subdomain.example.com can set a cookie that can be read by example.com.

subdomain.example.com can set a cookie whose Domain attribute is .example.com. RFC 2965 seems to explicitly state that such a cookie will not be sent to example.com, but then equally says that if you set Domain=example.com, a dot is prepended, as if you said .example.com. Taken together, this seems to say that if example.com returns sets a cookie with Domain=example.com, it doesn't get that cookie back! That can't be right.

Can anyone clarify what the rules really are?

Solution

Yes.

If you make sure to specify that the domain is .example.com, then *.example.com and example.com can access it.

It's that principal that allows websites that issue cookies when somebody goes to www.website.com to access cookies when someone leaves off the www, going to website.com.

EDIT: From the PHP documentation about cookies:

domain The domain that the cookie is available. To make the cookie available on all subdomains of example.com then you'd set it to '.example.com'. The . is not required but makes it compatible with more browsers. Setting it to www.example.com will make the cookie only available in the www subdomain. Refer to tail matching in the » spec for details. http://php.net/manual/en/function.setcookie.php

And it's not unique to PHP.

Comments

[Evan Plaice]

-1 That's called a 301 redirect and doesn't properly reflect what the question is asking.

[Aaron Yodaiken]

Evan, if you go to worldbreathday.org, and then go to worldbreathday.org, you'll note there is no redirection; and yet those two websites can still share cookies with each other. It's a well know phenomenon, look it up :)

[belkka]

@AaronYodaiken both links are broken now; cannot check :)