which you can't do with root domains as it affects all subdomains also.
rfc2109 disagrees:
A is a FQDN string and has the form NB, where N is a non-empty name
string, B has the form .B', and B' is a FQDN string. (So, x.y.com
domain-matches .y.com but not y.com.)
That's his point, setting a cookie on the root "domain.com" will mean it's sent to "www.domain.com" or "blog.domain.com" as well. You mostly do not want this.
However, I was a little tongue-in-cheek there. The RFC disagrees, but browsers have been doing it wrong for as long as I can remember. So, in practice he's right... ;)
Comments
which you can't do with root domains as it affects all subdomains also.
rfc2109 disagrees:
That's his point, setting a cookie on the root "domain.com" will mean it's sent to "www.domain.com" or "blog.domain.com" as well. You mostly do not want this.
Ahem, the text states the opposite of his point.
However, I was a little tongue-in-cheek there. The RFC disagrees, but browsers have been doing it wrong for as long as I can remember. So, in practice he's right... ;)