Hacker News new | past | comments | ask | show | jobs | submit login

Google's cookie situation is complicated, because they have one login that people expect to work across mail.google.com, docs.google.com, drive.google.com, etc. Without going to a ton of server-side gymnastics, the most seamless way to connect all those properties is to set the session ID cookie on .google.com, allowing access to all subdomains recursively.

There's no way to exclude certain subdomains, so once you've decided to share a cookie between subdomains you have to use a new domain if you want to exclude a site from sharing.




> There's no way to exclude certain subdomains

I think Google should fix this. The alternative is endless domain sprawl, for all time.




Consider applying for YC's Summer 2025 batch! Applications are open till May 13

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: