6

I'm baffled over a recent problem I'm having with use of a partial domain name cookies. I'm using partial domain cookies in my app to manage a single sign-on scenario. Everything was working fine until I happened to try it with the Google App Engine domain appspot.com.

Try as I may, I could not get the browser to accept appspot.com as a partial domain cookie. Here is the HTTP response header I am sending:

foo=bar;Path=/;Domain=.appspot.com

If my app is at http://my.appspot.com the browser ignores the set cookie. I can do this with other domains (e.g. google.com) and all is well (I am using my hosts file to direct the browser to my mac). It fails when I run it locally, on App Engine, or anywhere else.

I can't think of any reason this domain name would be special. Does anyone have any ideas?

Marvin Pinto
  • 30,138
  • 7
  • 37
  • 54
velohomme
  • 136
  • 2
  • 9
  • possible duplicate of [Is there any way to whitelist .appspot.com so I can set a cookie on that domain in Firefox 6?](http://stackoverflow.com/questions/7110681/is-there-any-way-to-whitelist-appspot-com-so-i-can-set-a-cookie-on-that-domain) – JB Nizet Jan 20 '12 at 17:24
  • This would be an enormous security/privacy issue if it were possible. – Nick Johnson Jan 24 '12 at 00:20

1 Answers1

7

I believe this might answer your question.

To quote:

I tested. It is not possible for a page of child domain to create a cookie for parent domain. Hence this issue dont exist.

Further clarification that might help; according to this Google Groups thread:

It appears that I cannot set a cookie with domain=.appspot.com

When I do that, it doesn't show up in the list of cookies. I can set a cookie in a sub-domain of .appspot.com (domain=foo.appspot.com) but not on appspot.com itself.

And Jon McAlister's reply:

It's because appspot.com was added to the public suffix list of domains that modern browsers should not allow cookies to be set for: see here

Marvin Pinto
  • 30,138
  • 7
  • 37
  • 54
  • Bang. You got it Jon. I verified the same problem with other domains in the public suffix list. Thanks!!! – velohomme Jan 20 '12 at 18:15