A cookie without a domain?

Question

Is it possible to set a cookie without a domain?

This will mean all domains will have access to it.

Ferrel

What underlying problem are you trying to solve? – Sasser

Answer 1

No, that is not possible. If a cookie doesn't declare a domain, the browser will assume the domain of the object requested.

What you're asking for is generally considered a security, or at least privacy, risk. It's possible to configure browsers to allow access to cookies from other than the domain that they were created, but browsers aren't commonly configured that way.

Sasser

Thanks for your answer. Follow up question, is possible to set cookie on domain but specify that another domain has access to it? – Ferrel

@jamjam, no, it isn't. The normal way of dealing with this restriction is to place all applications that need access to the same cookie in the same domain. – Sasser

not all browsers will assume domain if a cookie doesn't declare a domain. – Stigmasterol

see here.. FireFox 13 can also control whether domain is assumed when cookie doesn't declare one. – Stigmasterol

I don't see where the question you reference makes that point, @Frank. I'd be interested in a reference for the Firefox 13 setting. – Sasser

RFC2109The host or domain for which the cookie is set. presence of a leading dot indicates a domain cookie; otherwise, the cookie is treated as a non-domain cookie. See RFC2109 for details. The host string will be normalized to ASCII or ACE; any trailing dot will be stripped. To be a domain cookie, the host must have at least two subdomain parts (e.g. '.foo.com', not '.com'), otherwise an exception will be thrown. An empty string is acceptable (e.g. file:// URI's). – Stigmasterol

Yes, that is a quote from RFC2109, @Frank, and that RFC is discussed in the article I link to. How does that quote support your point? – Sasser

Plenty of homebrew scripts here that can override the default. You can use a fireFox add-on called Greasemonkey to run them! – Stigmasterol

Answer 2

RFC 2109 tells this parameter is optional. But depending on the browser, behavior may be different.

Molt