Skip to content

Commit 3c934b5

Browse files
author
Ilya Kantor
committedDec 24, 2021
minor fixes
1 parent 0cd40ae commit 3c934b5

File tree

1 file changed

+13
-9
lines changed

1 file changed

+13
-9
lines changed
 

‎6-data-storage/01-cookie/article.md

+13-9
Original file line numberDiff line numberDiff line change
@@ -102,32 +102,36 @@ It's a safety restriction, to allow us to store sensitive data in cookies that s
102102

103103
By default, a cookie is accessible only at the domain that set it.
104104

105-
...What's tricky, we won't get the cookie at a subdomain `forum.site.com`!
105+
Please note, by default a cookie is also not shared to a subdomain as well, such as `forum.site.com`.
106106

107107
```js
108-
// at site.com
108+
// if we set a cookie at site.com website...
109109
document.cookie = "user=John"
110110

111-
// at forum.site.com
111+
// ...we won't see it at forum.site.com
112112
alert(document.cookie); // no user
113113
```
114114

115-
...But if we'd like to allow subdomains like `forum.site.com` to get a cookie, that's possible. When setting a cookie at `site.com`, we should explicitly set the `domain` option to the root domain: `domain=site.com`:
115+
...But this can be changed. If we'd like to allow subdomains like `forum.site.com` to get a cookie set at `site.com`, that's possible.
116+
117+
For that to happen, when setting a cookie at `site.com`, we should explicitly set the `domain` option to the root domain: `domain=site.com`. Then all subdomains will see such cookie.
118+
119+
For example:
116120

117121
```js
118122
// at site.com
119123
// make the cookie accessible on any subdomain *.site.com:
120-
document.cookie = "user=John; domain=site.com"
124+
document.cookie = "user=John; *!*domain=site.com*/!*"
121125

122126
// later
123127

124128
// at forum.site.com
125129
alert(document.cookie); // has cookie user=John
126130
```
127131

128-
For historical reasons, `domain=.site.com` (a dot before `site.com`) also works the same way, allowing access to the cookie from subdomains. That's an old notation and should be used if we need to support very old browsers.
132+
For historical reasons, `domain=.site.com` (with a dot before `site.com`) also works the same way, allowing access to the cookie from subdomains. That's an old notation and should be used if we need to support very old browsers.
129133

130-
So, the `domain` option allows to make a cookie accessible at subdomains.
134+
To summarize, the `domain` option allows to make a cookie accessible at subdomains.
131135

132136
## expires, max-age
133137

@@ -180,7 +184,7 @@ With this option, if a cookie is set by `https://site.com`, then it doesn't appe
180184
// assuming we're on https:// now
181185
// set the cookie to be secure (only accessible over HTTPS)
182186
document.cookie = "user=John; secure";
183-
```
187+
```
184188

185189
## samesite
186190

@@ -247,7 +251,7 @@ But anything more complicated, like a network request from another site or a for
247251

248252
If that's fine for you, then adding `samesite=lax` will probably not break the user experience and add protection.
249253

250-
Overall, `samesite` is a great option.
254+
Overall, `samesite` is a great option.
251255

252256
There's a drawback:
253257

0 commit comments

Comments
 (0)
Failed to load comments.