Contents
Browser cookies can be shared across subdomains if their domain flag is set to a common parent domain. Usually, hackers steal the session cookies by finding a subdomain takeover, RCE, XSS, or any other vulnerability that would expose the user’s cookie.
You cannot share cookies across domains. You can however allow all subdomains to have access. To allow all subdomains of example.com to have access, set the domain to .
How can a site not access cookies stored by another site?
A properly designed browser will not allow a website to access another website’s cookies, as this would violate the cross-domain policy and be a major security issue.
Basically to have Cross-Domain LocalStorage, you create an iframe that’s hosted on your other domain, then you send PostMessage to that iframe and inside iframe you set that value of localStorage.
Please everyone note that you can set a cookie from a subdomain on a domain. (sent in the response for requesting subdomain.mydomain.com) But you CAN’T set a cookie from a domain on a subdomain. (sent in the response for requesting mydomain.com)
When to ignore cookie when domain does not match?
If the canonicalized request-host does not domain-match the domain-attribute: Ignore the cookie entirely and abort these steps. A string domain-matches a given domain string if at least one of the following conditions hold: The domain string and the string are identical.
Weak Integrity Cookies do not provide integrity guarantees for sibling domains (and their subdomains). For example, consider foo.example.com and bar.example.com.
Can a domain without a leading Dot be used on a subdomain?
In RFC 2109, a domain without a leading dot meant that it could not be used on subdomains, and only a leading dot ( .mydomain.com) would allow it to be used across multiple subdomains (but not the top-level domain, so what you ask was not possible in the older spec).