title: cookie dupes to domain without dot prefix
body: <p>I have this weird issue I cannot figure out, so I was hoping someone smarter than me could help!</p>
  
  <p>I have a site <code>https://example.com</code>  (no subdomain)</p>
  
  <p>I have some code that sets a cookie, e.g. </p>
  
  <pre><code>var value="some value";
  document.cookie="myCookie="+escape(value)+"; path=/; domain=example.com";
  </code></pre>
  
  <p>This code runs during page load in some script tag. When the page is first loaded, I see my cookie set, and in (chrome) dev tools > Application > Domain column, I see that it is set on <code>.example.com</code> with a leading dot, which is fine. </p>
  
  <p>But then I refresh the page, and my code runs again (and there is a new value being pushed to the cookie; dunno if that matters).  I look in the Application tab and I now see a "duplicate" entry for <code>myCookie</code> - one on <code>.example.com</code> and another on <code>example.com</code> (no leading dot).  The values are the same. <strong>This is weird to me and I do not know why this is happening. Does anybody have any possible reasons for why this can happen?</strong> </p>
  
  <p>Further down this rabbit hole.. I refresh the page again and the <code>myCookie</code> value on <code>.example.com</code> updates, but the one on <code>example.com</code> does not. More weirdness!</p>
  
  <p>Meanwhile, I have other code that tries to read the cookie, but apparently the <code>myCookie</code> cookie on <code>example.com</code> takes precedence and I get that value, not the latest value (reflected in the <code>.example.com</code> cookie).  </p>
  
  <p>I have tried explicitly setting the cookie on <code>.example.com</code> (<code>domain=.example.com</code>) but the described behavior above still happens.  Also, near as I can tell, there is no way for me in javascript to explicitly reference the cookie on <code>.example.com</code> - <code>document.cookie</code> just shows the <code>example.com</code> one (but the dev tools Applications tab does show it? So <em>is</em> this exposed in javascript?)</p>
  
  <p>I can't provide a link to the site, but I can try to answer any questions someone might have to clarify.  </p>
  
  <p>But my main question is: can anybody explain possible reasons this might happen, or at least offer something that might point me in the right direction? Or failing that, alternatively some workaround to explicitly read from <code>.example.com</code>? </p>
  
  <p><strong>Edit</strong></p>
  
  <p>At this point, my best guess is <em>something else</em> on the site, likely server-side script, is duping the cookies over from <code>.example.com</code> to <code>example.com</code> but only if the values change.  But this is pure speculation. I haven't been able to find any client-side proof of this (yet..) and I don't actually have access to server-side stuff.  And this is probably grasping at straws anyways. But it's my best working theory ATM to take back to the site devs to ask them about.. </p>
  
  <p><strong>Update - New stuff I have found / Clarifications</strong></p>
  
  <p>To be clear/restate: my site is on <code>https://example.com</code> with <strong>no</strong> submdomain. </p>
  
  <p>This seems to only happen for my cookies where the value changes each page load. Cookies whose values do not change do not seem to get pushed from <code>.example.com</code> to <code>example.com</code>. </p>
  
  <p>Even for the cookies with dynamic values, it only seems to dupe <code>.example.com</code> to <code>example.com</code> the <em>first</em> time. After that, the <code>example.com</code> cookie value does not change on subsequent page loads, even though the <code>.example.com</code> version gets a new dynamic value.</p>
  
  <p>I have created a test script, separate from the cookies I currently observe this behavior, in an effort to divide and conquer. I thought to rule out any shenanigans with the code that sets/reads the cookies and blackbox this as much as possible. </p>
  
  <p>But I am seeing the same behavior. I still suspect this is some kind of server wtfery going on, like the <code>.example.com</code> cookies are getting sent in the next http request and then the server is writing them back to <code>example.com</code>.. only on the first time? That's the double plot-twist. I don't have access to server-side stuff but I don't even know where to begin with what to holler at the site devs to look at. </p>
  
  <p>Also note that so far between my colleagues and I, we tested the both the javascript lib/code that sets the problem cookies, as well as the blackbox script below on 6 other sites (not even owned/affiliated with this problem site at all) and have <em>not</em> been able to reproduce the issue, which further makes us suspect it is some kind of server config issue (but again, we don't really know where to start with that). </p>
  
  <p>Anyways, in case it somehow helps anybody, below is the script I wrote to (further) test this issue. I am testing with a total of 8 cookies:</p>
  
  <ol>
  <li><strong>test_no_dot_static</strong> - I set <code>domain=example.com</code> with a static value</li>
  <li><strong>test_no_dot_dynamic</strong> - I set <code>domain=example.com</code>with a dynamic value</li>
  <li><strong>test_dot_static</strong> - I set <code>domain=.example.com</code> with a static value</li>
  <li><strong>test_dot_dynamic</strong> - I set <code>domain=.example.com</code> with a dynamic value</li>
  <li><strong>test_implicit_no_domain_static</strong> - I set a cookie with static value with <strong>no</strong> <code>domain=</code> specified</li>
  <li><strong>test_implicit_no_domain_dynamic</strong> - I set a cookie with dynamic value with <strong>no</strong> <code>domain=</code> specified</li>
  <li><strong>test_explicit_no_domain_static</strong> - I set a cookie with static value with <code>domain=</code> specified with <strong>no value</strong></li>
  <li><strong>test_explicit_no_domain_dynamic</strong> - I set a cookie with dynamic value with no <code>domain=</code> specified with <strong>no value</strong></li>
  </ol>
  
  <p><code>#1, #3</code> - These initially get set on <code>.example.com</code> and do not get duped to <code>example.com</code> on page refresh</p>
  
  <p><code>#2, #4</code> - These initially get set on <code>.example.com</code>. On first page refresh, the original value is duped to <code>example.com</code> cookie/domain. On 2nd+ page refresh, the <code>example.com</code> cookie values do not change (retain original value), and the <code>.example.com</code> versions get new values each page load. </p>
  
  <p><code>#5, #7</code> - These initially get set on <code>example.com</code> (not <code>.example.com</code>) and are there is never a version on <code>.example.com</code>.</p>
  
  <p><code>#6, #8</code> - These initially get set on <code>example.com</code> (not <code>.example.com</code>) and their values update each page load, and there is never a version on <code>.example.com</code> .</p>
  
  <p><strong>Test Code</strong></p>
  
  <pre><code>var s_testCookies = {
      getCookieValue: function(a) {
          var b = document.cookie.match('(^|;)\\s*' + a + '\\s*=\\s*([^;]+)');
          return b ? unescape(b.pop()) : '';
      },
      getRandomValue: function() {
          return '' + (new Date()).getTime() + '|' + Math.floor(Math.random() * 100000);
      },
      run: function(data) {
          var data = data || {};
          console.log('------------------------');
          console.log('Arg: ', JSON.parse(JSON.stringify(data)));
          data.previousValue = s_testCookies.getCookieValue(data.name);
          console.log('Previous: ', JSON.parse(JSON.stringify(data)));
          data.cookie = data.name + "=" + escape(data.value) + "; path=/;";
          data.cookie+= (typeof data.domain!='undefined') &amp;&amp; (" domain="+data.domain+";") || "";
          document.cookie = data.cookie;
          data.newValue = s_testCookies.getCookieValue(data.name);
          console.log('New: ', JSON.parse(JSON.stringify(data)));
          console.log('------------------------');
      }
  } // end testCookies
  
  s_testCookies.run({
      'message': 'no dot static value',
      'domain': 'example.com',
      'name': 'test_no_dot_static',
      'value': 'no dot static value'
  });
  s_testCookies.run({
      'message': 'no dot dynamic value',
      'domain': 'example.com',
      'name': 'test_no_dot_dynamic',
      'value': s_testCookies.getRandomValue()
  });
  s_testCookies.run({
      'message': 'dot static value',
      'domain': '.example.com',
      'name': 'test_dot_static',
      'value': 'dot static value'
  });
  s_testCookies.run({
      'message': 'dot dynamic value',
      'domain': '.example.com',
      'name': 'test_dot_dynamic',
      'value': s_testCookies.getRandomValue()
  });
  s_testCookies.run({
      'message': 'implicit no domain static value',
      'name': 'test_implicit_no_domain_static',
      'value': 'implicit no domain static value'
  });
  s_testCookies.run({
      'message': 'implicit no domain dynamic value',
      'name': 'test_implicit_no_domain_dynamic',
      'value': s_testCookies.getRandomValue()
  });
  s_testCookies.run({
      'message': 'explicit no domain static value',
      'domain':'',
      'name': 'test_explicit_no_domain_static',
      'value': 'explicit no domain static value'
  });
  s_testCookies.run({
      'message': 'explicit no domain dynamic value',
      'domain':'',
      'name': 'test_explicit_no_domain_dynamic',
      'value': s_testCookies.getRandomValue()
  });
  </code></pre>
  
  <p><strong>Another Update based on comments / answers provided</strong></p>
  
  <p>To be clear, in practice, the issue is that we have some cookies that we set with values on a page load. Then when the page is refreshed (or another page is navigated to on the site), we read the value, do something with it, generate a new value and set the cookies again.  Wash rinse repeat each page (re)load.  </p>
  
  <p>The issue is on initial page view, those cookies are set on <code>.example.com</code> domain. Then on next page load, the initial cookie/value gets duped to <code>exampe.com</code>, and also the cookie on <code>.example.com</code> gets an updated value.  Then on another page load, the previous <code>.example.com</code> value does not get duped/pushed to <code>example.com</code> version of the cookie; only the <code>.example.com</code> version updates.  So it only gets duped/pushed to <code>example.com</code> on the 2nd page load. Not 3rd+.   </p>
  
  <p>Meanwhile, the <code>example.com</code> cookie takes precedence and is the one <code>document.cookie</code> returns when we parse for the cookie value. So on 3rd+ page load, we just keep getting the value from page #2 returned from that <code>example.com</code> cookie, instead of the updated value in <code>.example.com</code></p>
  
  <p>Meanwhile, we cannot simply not specify a <code>domain=</code> value (<code>#6 or #8</code> above), because there are in fact subdomains in play e.g. <code>mobile.example.com</code> that also have the code that reads/updates/writes those cookies, and if we do not specify a domain, then the cookie is only available on exactly <code>example.com</code> and cannot be read on <code>mobile.example.com</code>.</p>
  
  <p><strong>Udpate</strong></p>
  
  <p><strong>@ffeast</strong> asked the following questions:</p>
  
  <blockquote>
    <p>What does curl -I yourdomain return? Are there any Set-Cookie headers?</p>
  </blockquote>
  
  <p>Here you go! </p>
  
  <pre><code>user@host:~$ curl -I https://example.com
  HTTP/1.1 200 OK
  X-Powered-By: Express
  set-cookie: site#lang=en; Path=/;Secure
  set-cookie: connect.sid=s%3As46fwOPaosGdwis0G_Wdv7gzUs75Q0rr.O1gLsLmrHmmdBXxPWJrIq8UWwOOaQf96qxUlW%2FxnEuM; Path=/; HttpOnly;Secure
  Cache-Control: no-cache, no-store, must-revalidate
  Pragma: no-cache
  Expires: 0
  Content-Type: text/html; charset=utf-8
  Content-Length: 19632
  ETag: W/"4cb0-bgHMEy79PzLMv7jhB1Lh6A"
  Vary: Accept-Encoding
  Date: Fri, 16 Mar 2018 20:42:19 GMT
  Connection: keep-alive
  Set-Cookie: SecureCookie=!zPdIdxiz3mOMe2MYzy1p873u0yWtMdduASsHoU06gkaLs306mhR7cb3ir4TA2EG2cQGKmeVWJeYvxA/flQfPQUixqL8WMOfROsTgu3UZZg==; path=/; Httponly; Secure
  </code></pre>
  
  <p>I also see the same Response Headers from browser tab. </p>
  
  <p>So there are some set-cookie headers in the initial http response, yes. They are not cookies I personally have anything to do with or know about for my scope of things, but I can ask what they are for, if that somehow helps. Example: </p>
  
  <p>I notice that a <code>domain=</code> value is not explicitly set for them.. is it possible this somehow sets a precedent for the browser, or am I barking up the wrong tree? Even if it did though, I don't think that explains the dupe to <code>example.com</code> only to my cookies that change their values, nor it only happening on 2nd page load (not 3rd+)? Not sure where you're going with this, but I'm all ears!</p>