cookieconsent icon indicating copy to clipboard operation
cookieconsent copied to clipboard

[Feat]: Allow leaving out `Domain` in CookieConsent cookie

Open jonasgeiler opened this issue 7 months ago • 2 comments

Description

Currently, CookieConsent will ALWAYS (except on localhost) set the ;Domain=... attribute on the cc_cookie cookie it creates to store preferences.
However, according to MDN, leaving out ;Domain=... when creating the cookie has a different behavior than explicitly setting the ;Domain=... attribute to f.e. window.location.hostname:

"If not specified, this defaults to the host portion of the current document location and the cookie is not available on subdomains. If a domain is specified, subdomains are always included. Contrary to earlier specifications, leading dots in domain names are ignored, but browsers may decline to set the cookie containing such dots."

Source: Document: cookie property - Web APIs | MDN

What I would like is that the cookie is only available on my root domain, NOT it's subdomains. However, this is currently not possible since I cannot prevent ;Domain=... from being specified...

Please add a way to prevent CookieConsent from specifying ;Domain=... when creating it's cookie.

Proposed solution

Maybe, when cookie.domain is null, it will explicitly leave it out:

CookieConsent.run({
  cookie: {
    domain: null, // Don't set `;Domain=...`
    // ...
  },
  // ...
});

Or, use an extra config key, like cookie.omitDomain:

CookieConsent.run({
  cookie: {
    omitDomain: true, // Don't set `;Domain=...`
    // ...
  },
  // ...
});

Additional details

Here is the code which always adds the ;Domain=... attribute to the cookie: https://github.com/orestbida/cookieconsent/blob/c3882de2822a26eb9842c8b019d228374cf9b075/src/utils/cookies.js#L268

jonasgeiler avatar May 30 '25 18:05 jonasgeiler

Yes, this was already discussed here.

And I am fine with implementing it with this approach:

domain: <any falsy value>

orestbida avatar May 31 '25 10:05 orestbida

@orestbida wrote: Yes, this was already discussed here.

And I am fine with implementing it with this approach:

domain: <any falsy value>

Ah, damn, didn't look at the discussions to look for duplicates. But glad this is getting attention! Thanks a lot!

jonasgeiler avatar May 31 '25 13:05 jonasgeiler