We need to set the domain as .example.com to make it available for *.example.com,
but why not example.com?
We need to set the domain as .example.com to make it available for *.example.com,
but why not example.com?
The dot at the beginning says it'll be available for all subdomains. It's just... needed :)
If you don't use the initial dot, you'd be telling it to be only available for example.com (not even www.example.com).
example.com means "exactly" example.com ; and nothing more.
If example.com was used to mean *.example.com, how would you set a cookie that's valid on example.com and not on subsite.example.com ?