In short:
RFC 2965 is the reference for HTTP State Management, i.e. cookies.
http://rfc.net/rfc2965.html
It defines:
User Agent Role:
Domain Defaults to the effective request-host. (Note that because
there is no dot at the beginning of effective request-host,
the default Domain can only domain-match itself.)
Highlight: "default Domain can only domain-match itself"
So requesting a page from
www.domain.com should only have cookies that
domain-match
www.domain.com exactly in its HTTP header "Cookie:".
But IE6 SP2 sends not only
www.domain.com cookies, but also domain.com
cookies.
This behavior would be correct if this were not default-domain cookies, i.e.
if the domain was set explicitly by the server to .
www.domain.com, then the
browser would be allowed to send cookies with domain .
www.domain.com and
..domain.com.
But not for cookies with default domain.
Mozilla Firefox and Opera handle it correctly and send only cookies back
that match the default-domain exactly.
Yours sincerely - Andy Staudacher
Similar Threads
