[hrjet]

Why isn't the obvious fix discussed: Change browsers to not let subdomains set cookies for parent domains.

Probably this feature is of critical use. If so, would be grateful if someone explains it to me.

[_delirium]

One common use is to pass session data between subsections of a site. For example, the user logs into www.example.com, and is still logged in when they head over to store.example.com.

[hrjet]

That could be also implemented in my proposed fix by example.com setting the auth cookies. They will continue to be readable by store.example.com.

Sure, it will require a change on the server side, which is a pain. But I can't think of a practical scenario which will be impossible to implement with the proposed fix.

[gfodor]

Your idea would likely break any site on the internet that uses authentication and subdomins, isn't it clear why this isn't being considered?

[zaroth]

Or sites could opt-in to this with a header?

EDIT: homakov says the same thing down thread.

[hrjet]

Yes, it is backwards incompatible. Perhaps it could be enforced in HTTP 2?