Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Due to changes made in #64 it's not possible to disable cookies for subdomains, they're always on.
Expected behavior
setDomain('example.com')
orinit(..., { domain: 'example.com' });
would set cookies forexample.com
without subdomainssetDomain('')
orinit(..., { domain: '' });
orinit(..., { domain: null });
would set cookies for the current domain without subdomainsActual behavior
setDomain('example.com')
orinit(..., { domain: 'example.com' });
sets cookies for.example.com
.setDomain('')
orinit(..., { domain: '' });
orinit(..., { domain: null });
is ignored due to non-empty string check hereThis happens because of the document.cookie syntax:
leading dots in domain names are ignored, but browsers may decline to set the cookie containing such dots. If a domain is specified, subdomains are always included.
New behavior
Docs are updated to reflect the fact that any specified domain will include all subdomains. There's no workaround for that. Trailing dot for cookies domain is useless, may lead to cookies being declined and has been removed.
setDomain('')
orinit(..., { domain: '' });
orinit(..., { domain: null });
sets cookies only for the current domain sincedocument.cookie=
is called without a specific domain.