I was debugging why an empty value in the cookie domain still resulted in a domain value being set in the session cookie and came across this weird code in Mage_Core_Model_Session_Abstract_Varien:

    // session cookie params
    $cookieParams = array(
        'lifetime' => $cookie->getLifetime(),
        'path'     => $cookie->getPath(),
        'domain'   => $cookie->getConfigDomain(),
        'secure'   => $cookie->isSecure(),
        'httponly' => $cookie->getHttponly()

    if (!$cookieParams['httponly']) {
        if (!$cookieParams['secure']) {
            if (!$cookieParams['domain']) {

    if (isset($cookieParams['domain'])) {
        $cookieParams['domain'] = $cookie->getDomain();

So, the logic is this:

  1. $cookie->getConfigDomain() returns the domain configured for the store verbatim. This can be empty.
  2. and this is the weird part:
    1. if httponly is not set
    2. if secure is not set
    3. only then we unset the domain key in cookieParams
  3. if the domain key is NOT unset, we fill the domain with the HTTP Host.

I don't understand the rationale for the nesting of those 3 if statements. Is it known and am I missing a standard or is it a bug?

Reason I ask is that in recent cookie standards simply setting the domain value of the cookie, implies you set it for the domain and it's direct subdomains.

Only if you do not set a domain attribute on the cookie, the host only rule applies. Apparently you can prepend a dot for compatibility with the original RFC 2109 implementation, but it's optional.

Ref: http://en.wikipedia.org/wiki/HTTP_cookie#Domain_and_Path

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.