Double Submit Cookies is not vulnerable to sub-domain attacks (well no more so than a normal authentication cookie is, which would negate the risk here).

Assuming the cookie from your main site was set on the `www` subdomain (`www.example.com`), and other sites were on their own at the same level (e.g. `foo.example.com`) then apart from the [Session Fixation][1] risk detailed in your linked question (where an authcookie is set at `example.com` level for a visitor visiting `foo.example.com` to then fixate their session at `www.example.com`) there is no risk to CSRF tokens, even if they are stored in cookies.

This is because a CSRF token should be tied to the user session, so if you managed to fixate the CSRF value this would be useless in isolation. What I'm trying to say that if an attacker has managed to fixate the user session, they will already have access to that session themselves so will already have the CSRF value without grabbing it separately from a cookie.

For a secure setup, you should control all subdomains of the site you wish to secure. This is because the [Same Origin Policy][4] is more lax for cookies than for DOM objects.

You should use HTTPS for your site and you should also set the [Secure Flag][2] on the auth and CSRF cookies to make sure that they are sent only over an HTTPS connection.

----------

PS. Yes I saw your comment on my [other post][3]. I hope this answers your question there.

  [1]: https://www.owasp.org/index.php/Session_fixation
  [2]: https://www.owasp.org/index.php/SecureFlag
  [3]: http://stackoverflow.com/a/20518324/413180
  [4]: http://en.wikipedia.org/wiki/Same-origin_policy