title: Can subdomain.example.com set a cookie that can be read by example.com?
body: <p>I simply cannot believe this is quite so hard to determine.</p>
  
  <p>Even having read the RFCs, it's not clear to me if a server at subdomain.example.com can set a cookie that can be read by example.com.</p>
  
  <p>subdomain.example.com can set a cookie whose Domain attribute is .example.com.  RFC 2965 seems to explicitly state that such a cookie will not be sent to example.com, but then equally says that if you set Domain=example.com, a dot is prepended, as if you said .example.com.  Taken together, this seems to say that if example.com returns sets a cookie with Domain=example.com, it doesn't get that cookie back! That can't be right.</p>
  
  <p>Can anyone clarify what the rules really are?</p>