in reply to HTTP cookies and spoofing domain names

CGI.pm is reporting all the cookies it gets. It's your browser that decides what cookies to send. And yes, this is by design, so nobody can look at anyone else's cookies.

-- Randal L. Schwartz, Perl hacker
Be sure to read my standard disclaimer if this is a reply.

  • Comment on Re: HTTP cookies and spoofing domain names

Replies are listed 'Best First'.
Re^2: HTTP cookies and spoofing domain names
by jhourcle (Prior) on Apr 02, 2005 at 21:48 UTC
    For more information on what merlyn said, see RFC 2965. You can restrict cookies by domain, server, path, port and to only HTTPS.

    If you wish to share cookies between servers (even if they're physically the same system, but use different host names), you'll need to set the cookies in a domain that all of the hosts share. If you don't control all of the systems in your domain, you can place them in a subdomain (assuming you have access to DNS in your domain).

    For example, I can take two systems, in domain.tld, and give each one a CNAME in shared.domain.tld, so I can then set cookies to be shared between the two systems in .shared.domain.tld (note the initial period). Of course, if someone follows a link that does not refer to the machines as being in the shared subdomain, the cookies won't be sent from the browser. (which can be useful to set both shared and unshared cookies, but you can mess it up very, very easily, if you're not careful.