Safari removes leading dot from Set-Cookie domain on local http webserver

I have a local webserver (puma-dev serving a Rails app) running on `mydomain.test` and which shares cookies over subdomains like `me.mydomain.test`.


The response from the webserver when I log in correctly includes a `Set-Cookie` header like so:

```

Set-Cookie: _mydomain_admin_session=abc123_a_long_token; domain=.mydomain.test; path=/; HttpOnly

```


However, when I look in the Storage panel of the Web Inspector, the cookie is there, but its domain is set to `mydomain.test`, which is incorrect. This means I cannot access http://me.mydomain.test because I don't have the cookie to authenticate. To get past this, every time I log in I have to edit the stored cookie manually to add the leading dot back in.


This works fine for Chrome and Firefox without needing to edit the cookie manually. Also, Safari correctly includes the leading dot for the same app in our production environment, so login works fine for our users.


Why is Safari removing the leading dot for my local webserver? Is there anything I can do to tell it keep the leading dot? I have ensured that Content Blockers are turned off for my local webserver, and unchecking "Prevent cross-site tracking" doesn't fix it for me so I've kept that checked for security when browsing other sites as Safari is now my main browser for personal usage and developing.


Thanks in advance,

Henry

MacBook Pro 13″, macOS 10.15

Posted on Feb 15, 2021 4:57 AM

Reply

Similar questions

There are no replies.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Safari removes leading dot from Set-Cookie domain on local http webserver

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.