Re: [http-state] Ticket 6: host-only cookies

[Adam Barth <[e-mail]>]

On Tue, Feb 2, 2010 at 8:37 AM, Dave Kristol <[e-mail]> wrote:
> Adam Barth wrote:
>>
>> I've added the following text to the server section, as recommend by
>> Dan Winship:
>>
>>              <t>WARNING: Some legacy user agents treat an absent Domain
>>              attribute as if the Domain attribute were present and
>> contained
>>              the current host name. For example, if example.com returns a
>>              Set-Cookie header without a Domain attribute, these user
>> agents
>>              will send the cookie to www.example.com.</t>
>
> If the implied Domain attribute is example.com, then the user agent may only
> return the cookie to example.com.

Do you mean that

Set-Cookie: foo=bar; Domain=example.com

and

Set-Cookie: foo=bar; Domain=.example.com

are treated differently by user agents?  That might be true according
to 2109 (I'd have to check), but I don't think that's how user agents
work in practice.  They appear to ignore the leading dot.  If you have
a test case that show a difference, I'd be very interested in seeing
it.

Adam