Cookie behavior in Django

Question

I've been doing some research on cookies in Django for some time now.

However, I don't understand the following.

The default setting in django for the SESSION_COOKIE_DOMAIN is None so the domain attribute will be empty.

Django sets the session cookie in the session middleware:

response.set_cookie(
    # ...
    domain=settings.SESSION_COOKIE_DOMAIN,
) 

The set_cookie function from the response object has the following relevant part if the domain is None which is the default setting in Django:

if domain is not None:
    self.cookies[key]['domain'] = domain

Therefore, I assume that the domain in the cookie header is omitted.

I've read this great article about cookies and user2864740 made a nice conclusion about it:

"When no domain is set in the cookie, the cookie should only match the exact host name of the request. No sub domains, no partial matches.

This means simply not including the domain attribute – it is not valid to set an empty domain attribute."

1.) Why does the cookie still work if it's not valid to leave the domain attribute empty or did I missunderstood something here?

2.) Let's assume I own the domain example.com

I don't modify the default settings from django so SESSION_COOKIE_DOMAIN is None

If I inspect the cookies for the domain example.com I see the following:

• Name: sessionid
• Value: XXXXXX
• Host: example.com

I thought setting a cookie domain without a preceding dot is invalid. Why does Django not use .example.com?

Is it basically the same if the cookie domain is example.com because it will produce the same behaviour as with a preceding dot?

3.) Did I understand it correctly that if I set a cookie on example.com (without www) the cookie will also be available on all subdomains and it's currently not possible to set a cookie only on the main domain that is not available on subdomains.

Answer 1

1.) Why does the cookie still work if it's not valid to leave the domain attribute empty or did I missunderstood something here?

The code you just pointed to makes clear that no domain is set in the response; the key is simply not included. What would be invalid (more precisely, "undefined"), would be including the key Domain but leaving out an attribute value. Django doesn't do that.

2.) I thought setting a cookie domain without a preceding dot is invalid. Why does Django not use .example.com?

First, you have that backwards. RFC 6265 says that a leading dot "is not permitted" (though it will simply be ignored if it's there).

Secondly, the cookie details you've shown don't include a Domain key. "Host" is not a cookie attribute; that's presumably just Chrome telling you where the cookie came from.

3.) Did I understand it correctly that if I set a cookie on example.com (without www) the cookie will also be available on all subdomains and it's currently not possible to set a cookie only on the main domain that is not available on subdomains.

Right.