Cookie is shared with every subdomain

MediumConfirmedweb.cookies.overly-broad-domain

What this check looks for

The cookie carries a Domain attribute, so it is not scoped to this host alone: every subdomain of that domain receives it too — including ones you may not control. That is a reasonable choice if the site genuinely spans subdomains; it is worth knowing either way.

Why it matters

A cookie scoped to the whole domain is sent to every subdomain: a marketing site, a status page, a customer-controlled subdomain, an old staging host. Any one of those being compromised means the cookie is exposed, and none of them needed it.

When the check passes, your report says: “The cookie is scoped to this host, not to every subdomain”.

What it costs your score

When this check fails it removes 8 points from your Web security score, before the status, confidence and repeat multipliers are applied. Web security carries a weight of 8 in the overall score.

It shares the web-security.cookies family ceiling of 30 points: however many findings that family produces, together they cannot remove more than that from Web security. One underlying problem showing up in several places is still one problem.

Severity: medium
Default confidence: confirmed
Status when triggered: warn
Deduction: 8 points
Family cap: web-security.cookies · 30
Category: Web security
Module: Web cookies
Fix owned by: user
In the ruleset since: 2026.09

How the whole score is calculated

How to fix it

Drop the Domain attribute unless a subdomain genuinely needs the cookie.

Every subdomain receiving the cookie is another place it can leak from.

Remove Domain to make the cookie host-only.
If a subdomain does need it, scope it to that subdomain rather than to the whole domain.
For a session cookie, use a __Host- prefix so the browser enforces host-only scoping.

How to confirm it worked

curl -sSI https://‹host›/ | grep -i '^set-cookie:'

The configuration to publish

Set-Cookie: __Host-{{cookie}}=...; Secure; HttpOnly; SameSite=Lax; Path=/

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Remediation by platform

nginx

# Only for a cookie from an upstream you cannot change. Fix it in the application first.
proxy_cookie_flags ~ secure httponly samesite=lax;

Apache

<IfModule mod_headers.c>
	# Workaround for a cookie from an upstream you cannot change.
	Header always edit Set-Cookie ^((?!.*;\s*Secure).*)$ "$1; Secure; HttpOnly; SameSite=Lax"
</IfModule>

Caddy

header {
	+Set-Cookie "{http.response.header.Set-Cookie}; Secure; HttpOnly"
}

Express

res.cookie('session', value, {
  secure: true,
  httpOnly: true,
  sameSite: 'lax',
  path: '/',
});

Requires nginx 1.19.3 or later. This rewrites cookies passing through the proxy; it cannot help for a cookie the browser receives some other way.
Shown because the response identified Apache. It is a last resort: set the attributes where the cookie is created. Put it in the virtual host — .htaccess runs too late to edit a header the proxy module has already emitted.
Also a workaround; prefer setting the attributes in the application.

Technical detail

‹cookie› sets Domain=‹value›. ‹detail›

RFC 6265bis §5.7 sets the host-only flag *only* when there is no Domain attribute at all. Any value clears it — including one written out as the host itself — and §5.8.3 then sends the cookie to every host that domain-matches it. So Domain= equal to the host is not the same as omitting it: it is the difference between one host and that host plus everything under it.

Sharing a cookie across subdomains is a deliberate and ordinary choice for a site that genuinely spans them, and this is reported as a scope to be aware of rather than as a mistake. What it costs is that every subdomain becomes a place the cookie can leak from. A Domain equal to the host is graded lower than one at the registrable domain, because the reach is smaller. The __Host- prefix enforces host-only scoping at the browser, which is why it is the recommended shape for a session cookie.