Cookies from subdomains are ignored by the CookiePlugin

[andrewkharook]

Q	A
Bug?	yes
New Feature?	no
Version	1.4.1

Actual Behavior

Cookie coming from the same domain but different subdomain is ignored.

Expected Behavior

The cookie for subdomain should be caught and saved to cookie jar (unless current behavior is what you have initially planned).
Or, at least we should provide a way for developer to choose if he wants to restrict cookies to single domain.

Steps to Reproduce

Imagine that initial request is made to www.example.com which tries to set cookie for all subdomains:
.example.com

Lines 71-74 will ignore that cookie, since strpos('.example.com', 'www.example.com') will return false:

// Restrict setting cookie from another domain
if (false === strpos($cookie->getDomain(), $request->getUri()->getHost())) {
    continue;
}

Possible Solutions

A quick and dirty solution would be to simply switch the arguments inside strpos(), like this:

// Restrict setting cookie from another domain
if (false === strpos($request->getUri()->getHost(), $cookie->getDomain())) {
    continue;
}

I can make a pull request with that change if you find it appropriate.

However, as I have said earlier, it would be better to let the developer decide whether to accept different domain cookies or not.

[dbu]

i think we should this correctly according to the specification. if you could look up the relevant RFC that would be great. this is probably not only about when to store a cookie but also about when to send it along. in your example, a request to api.example.com should also carry the cookie we got for .example.com

i would consider fixing this a bugfix. i don't see good use cases why one would want to change the behaviour from the spec , thus i don't think we need configuration options for that.

would be awesome if you can look into this @andrewkharook

[andrewkharook]

Well, in earlier specifications, a domain without a leading dot meant that the cookie could not be used on subdomains, and only a leading dot (.example.com) would allow it to be used across subdomains.

However, according to modern RFC 6265:

If the first character of the attribute-value string is %x2E ("."):

• Let cookie-domain be the attribute-value without the leading %x2E (".") character.

Otherwise:

• Let cookie-domain be the entire attribute-value.

In other words, if a domain is specified, subdomains are always included.
Preparing a pull request.