Cookies on localhost with explicit domain

Question

I must be missing some basic thing about cookies. On localhost, when I set a cookie on server side and specify the domain explicitly as localhost (or .localhost). the cookie does not seem to be accepted by some browsers.

Firefox 3.5: I checked the HTTP request in Firebug. What I see is:

Set-Cookie:
    name=value;
    domain=localhost;
    expires=Thu, 16-Jul-2009 21:25:05 GMT;
    path=/

or (when I set the domain to .localhost):

Set-Cookie:
    name=value;
    domain=.localhost;
    expires=Thu, 16-Jul-2009 21:25:05 GMT;
    path=/

In either case, the cookie is not stored.

IE8: I did not use any extra tool, but the cookie does not seem to be stored as well, because it’s not being sent back in subsequent requests.

Opera 9.64: Both localhost and .localhost work, but when I check the list of cookies in Preferences, the domain is set to localhost.local even though it’s listed under localhost (in the list grouping).

Safari 4: Both localhost and .localhost work, but they are always listed as .localhost in Preferences. On the other hand, a cookie without an explicit domain, it being shown as just localhost (no dot).

What is the problem with localhost? Because of such a number of incostencies, there must be some special rules involving localhost. Also, it’s not completely clear to me why domains must be prefixed by a dot? RFC 2109 explicitly states that:

The value for the Domain attribute contains no embedded dots or does not start with a dot.

Why? The document indicates it has to do something with security. I have to admit that I have not read the entire specification (may do it latet), but it sounds a bit strange. Based on this, setting cookies on localhost would be impossible.

Answer 1

by design domain names must have at least two dots otherwise browser will say they are invalid (see reference on http://curl.haxx.se/rfc/cookie_spec.html)

when working on localhost (!) the cookie-domain must be set to "" or NULL or FALSE instead of "localhost"

for php see comments on php.net function.setcookie.php

Answer 2

I have the same problem on Firefox 3.5 and IE8. When a user first visit the site, the page writes cookie into both secure domain and non-secure domain. Firefox set cookie for non-secure domain (where users are) fine, but just ignore secure domain set-cookie in the response header. The domain I use have at least two dots in them. Anyone know any work around for this? Thanks!