What are the security implications of domain-wide cookies (Domain=.example.com)?
❓ Interview Prompt: Explain domain cookie scoping, wildcard parent domains, XSS blast radius, and single-origin cookie isolation.
When setting cookies, developers often set 'Domain=.example.com' so that authentication cookies automatically share across subdomains ('app.example.com', 'blog.example.com', 'forum.example.com').
Severe Security Risk:
If a single low-security subdomain (e.g. an unmonitored WordPress instance on 'blog.example.com') suffers a Cross-Site Scripting (XSS) exploit, scripts running on 'blog.example.com' can read or overwrite the 'Domain=.example.com' authentication cookies for the main application on 'app.example.com'!
Best Practice:
Omit the 'Domain' attribute entirely! Omitting 'Domain' restricts the cookie strictly to the exact origin host that set it, preventing subdomain XSS contamination.
Code Implementation Example
// INSECURE: Shares cookie across ALL subdomains
res.setHeader('Set-Cookie', 'session=xyz; Domain=.example.com; HttpOnly; Secure');
// SECURE: Restricts cookie strictly to the current exact host (e.g. app.example.com)
res.setHeader('Set-Cookie', 'session=xyz; HttpOnly; Secure; SameSite=Strict');Omit the Domain cookie attribute to restrict cookies to exact host origins, preventing subdomain XSS cookie leaks.