Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix cookies for subdomains setup #205

Open
wants to merge 1 commit into
base: v8.x
Choose a base branch
from

Conversation

kshnurov
Copy link

@kshnurov kshnurov commented Nov 9, 2019

Due to changes made in #64 it's not possible to disable cookies for subdomains, they're always on.

Expected behavior

  1. setDomain('example.com') or init(..., { domain: 'example.com' }); would set cookies for example.com without subdomains
  2. setDomain('') or init(..., { domain: '' }); or init(..., { domain: null }); would set cookies for the current domain without subdomains

Actual behavior

  1. setDomain('example.com') or init(..., { domain: 'example.com' }); sets cookies for .example.com.
  2. setDomain('') or init(..., { domain: '' }); or init(..., { domain: null }); is ignored due to non-empty string check here

This happens because of the document.cookie syntax: leading dots in domain names are ignored, but browsers may decline to set the cookie containing such dots. If a domain is specified, subdomains are always included.

New behavior

  1. Docs are updated to reflect the fact that any specified domain will include all subdomains. There's no workaround for that. Trailing dot for cookies domain is useless, may lead to cookies being declined and has been removed.

  2. setDomain('') or init(..., { domain: '' }); or init(..., { domain: null }); sets cookies only for the current domain since document.cookie= is called without a specific domain.

@jooohhn jooohhn changed the base branch from master to main January 13, 2021 20:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant