Webpages can only set cookies for the second (or higher) level domain that they belong to.
This means that secure.example.com
can read and set cookies for secure.example.com
or .example.com
, the latter of which can also be read and set by www.example.com
One last note: If the secure flag is set on a cookie, it can only be read and set over an https connection.
与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…