Does a session cookie on different subdomain count as 3rd-party?
Cookies seem to be considered 3rd party if they come from different base domains (base domains being example.com
or example.co.uk
), but not if they come from different subdomains of the same base domain.
myapp.example.com
will be able to set cookies with domain myapp.example.com
if it is embedded within www.example.com
.
Having myapp.example.com
set cookies with domain .example.com
is unnecessary unless those cookies need to be read from a different subdomain.
[Tested in Firefox, Chrome (with 3rd party cookies blocked) and Safari] [ThirdPartyUtil.IsThirdPartyInternal seems to be where this is checked in Firefox]
if you set a Cookie on domain .example.com
then a cookie from www.example.com and www.myapp.example.com will be considered the same.
no cookie is treated as a 3rd party cookie.