Mar 27, 2026 - For details about updated CVE-2025-53521 (BIG-IP APM vulnerability), refer to K000156741.

Forum Discussion

Approxee's avatar
Approxee
Icon for Nimbostratus rankNimbostratus
Sep 29, 2017

Cookie sets domain the same as the requesting Host Header

I have a cookie set with the domain name the same as the requested Host header and I have another cookie set where does not specify the domain. So both cookies end up saved for the same domain locati...
ASM Advanced WAF
cookies
security
Jad_Tabbara__J1's avatar
Jad_Tabbara__J1
Icon for Cirrostratus rankCirrostratus
Sep 29, 2017

Hi,

 

so if I understand you have :

 

  • cookie1 domain=domain.com
  • cookie2 domain=host.domain.com
  • TSxxxx1 //set to cookie1
  • TSxxxx2 // set to cookie2

Correct ?

 

By default, if no "domain" is set the cookie is played by the client only for the specific "host".

 

When setting the "domain" attribute it the cookie is played to all subdomains.

 

So normally, depending on the need, only one cookie should be sufficient...

 

Did you asked the "application team" why this is used like that ?

 

Regards