why doesn't cfcookie allow setting domain= to a subdomain for CFID/CFTOKEN?

Question

<cfcookie name="CFID" value="#session.cfid#" domain=".demo.labs.dev">

yields:

Set-Cookie: CFID=4215; Domain=.labs.dev; Expires=Sat, 04-Jul-2043 01:43:49 GMT; Path=/; HttpOnly

But if I use <cfheader> directly:

<cfheader name="Set-Cookie"
      value="CFID=4212; Domain=.demo.labs.dev; Expires=Sat, 04-Jul-2043 01:37:03 GMT; Path=/; HttpOnly">

yields:

Set-Cookie: CFID=4212; Domain=.demo.labs.dev; Expires=Sat, 04-Jul-2043 01:37:03 GMT; Path=/; HttpOnly

And that's really what I want.

Why does <cfcookie> behave this way? Current workaround would be using <cfheader> instead.

https://bugbase.adobe.com/index.cfm?event=bug&id=3593673 – Henry Jul 11 '13 at 18:03 — Henry, Jul 11 '13 at 18:03

score 1 · Answer 1 · answered Jul 11 '13 at 13:23

1

Have you reproduced this error with a leading . in the domain value? According to CF8, CF9 and CF10 docs, the domain attribute value Must start with a period..

answered Jul 11 '13 at 13:23

Alex

1,979
16
24

The spec said client should treat it as having leading `.` – Henry Jul 11 '13 at 17:54

score 0 · Accepted Answer · answered Feb 28 '15 at 02:42

0

Apparently it is now fixed...

https://bugbase.adobe.com/index.cfm?event=bug&id=3593673

answered Feb 28 '15 at 02:42

Henry

32,689
19
120
221

why doesn't cfcookie allow setting domain= to a subdomain for CFID/CFTOKEN?

2 Answers2

Linked