on 3/17/05 6:32 PM, Brian Dunning at brian@xxxxxxxxxxxxxxxx wrote: >> I suspect it's >> for sub-domains of sites you administer and not completely different >> domains altogether. > > If this is true, and it's not possible for a site to set a cookie for a > completely different domain, then why do browsers have security options > to allow or prevent this specific action? I'm thinking it must be > possible, and that there's a reason for the domain option in > setcookie() other than subdomains. Would just love to know how to make > it work... The domain option exists in scripting implementations solely for the purpose of sub domains. It is not there to imply you can use it for more than one domain, but to allow you to secure your sub domains. If you set a cookie for .example.com then test.example.com and *.example.com etc will be able to read it. This is not always what you want, in some cases, you may have intranet.example.com and www.example.com and you would not want to set the domain parameter to .example.com as that would allow one to read your intranet cookies. You will simply never make it work, it is designed to never allow this. There has been one security issue I can think of to date that allowed it, but it was patched promptly. The day someone figured out how to set a cookie for amazon.com and read it while under some other domain is the day all the news sites will be covering that topic. Cross domain cookies are indeed possible, look at microsoft.com, msn.com and msnbc.com which indeed do share your cookies from one site to the next, however, they do it by redirects and get/post methods, which is perfectly legit since they control those domains. No one outside someone with access to those servers could implement it. You are misinterpreting the prefs in browsers, they can not do what you ask. -- ------------------------------------------------------------- Scott Haneda Tel: 415.898.2602 <http://www.newgeo.com> Novato, CA U.S.A. -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
