Everywhere I look, I only find explanations as to who can set who's cookies and who can access the cookies of whom.

Why do we need these restrictions?
More precisely:

  1. Why is it OK for a subdomain to set a cookie for a parent domain?
  2. Why is it not OK for a parent domain to set a cookie for a subdomain?
  • Have you looked up the concept of cookie security?
    – schroeder
    Aug 3, 2022 at 14:03
  • Duplicate? security.stackexchange.com/questions/231735/…
    – schroeder
    Aug 3, 2022 at 14:06
  • I did looked up cookie security and did not find any answer to this question security-wise. All I find is use cases and the specification for what can be done, but I'm asking for the why - why the ones who specified it this way thought that this is the most secure way? did they even think about security? Aug 4, 2022 at 11:09
  • 1
    The matching rules I understand, I just don't understand the reason for why it is allowed for a subdomain to set it's parent's cookie (as it effectively means a subdomain can set cookies for all other subdomains) but its not allowed for a parent domain to set cookies for it's subdomain but it can set it's own cookie and it will be sent to the subdomain as well. Aug 6, 2022 at 6:21
  • 1
    I'm looking for the security-wise logic, I'm trying to understand the motivation for these rules rather than what they do which is clear to me Aug 6, 2022 at 6:22

1 Answer 1


The main reason for this is security. If a website could set cookies for any other website, then it would be possible for that website to track users across the internet without their knowledge.

Another reason is that it can cause problems with how the website functions. If a website sets a cookie for a different domain, then that cookie may not be accessible when the user visits that domain. This can cause issues with login sessions, for example.

  • 2
    The question is about subdomains, not "any" website. Why are permissions set one way but not the other? This appears to miss the question entirely.
    – schroeder
    Aug 4, 2022 at 8:43
  • and this is exactly what I respond to, how are you going to know the answer to something you don't even know what is for and how it works?! Plus giving cookies to sub-domains is a big risk since they can be taken over, is not a brainer.
    – c0d3x27
    Aug 4, 2022 at 12:29
  • But then how is it possible to track a user "across the internet" if the scope is constrained to the domain? I'm trying to help you provide better answers that can more clearly address the question.
    – schroeder
    Aug 4, 2022 at 12:32
  • Tracking a user "across the internet" can be done using cookies, web beacons, or other tracking technologies. Web beacons can be used to track a user's activity on a website, but they can also be used to track other activities, such as what pages a user visits or what ads they click on.
    – c0d3x27
    Aug 4, 2022 at 12:39
  • 1
    I do understand how cookies works but as schroeder said, your answer doesnt address the question. I understand what is possible and not possible to do and I know the risks and what is problematic security-wise. What I dont understand is why it was defined this way the first place. Aug 6, 2022 at 6:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .