Do you actually need to set the domain? Quoting from the CGI documentation: If no domain is speci­fied, then the browser will only return the cookie to servers on the host the cookie originated from. Is this what you want it to do?