Sub domain cookie security

cookies

Solution

Cookie domains are suffix matching, so cookies of `www.abc123.com` will not be sent on the site of `some.abc123.com` and visa versa.

To have cookies be sent on both domains you should use `.abc123.com` as the domain.

Problem

Very simple question here. Knowing about cross domain cookie security, does the same apply to sub domains? EG. Should I be able to read a cookie set on some.abc123.com from the sub domain of www.abc123.com?

Original source

Related problems