Modifying cookie domain in Google Tag Manager from ".example.com" to "example.com" - cookies

on my website I have Google Tag Manager with a GA Universal Analytics Tag installed. All images on the site are on a dedicated subdomain: images.example.com
My issue is that Analytics sets its _ga cookie to ".example.com" so it is sent along with all requests to images.example.com. I would like to set the cookie domain to "example.com" (without the dot) so it does not apply to my image-only subdomain.
I have already set the "Cookie Domain" setting to a macro which is a constant with the value "domain.com" and even though the container is properly published the cookie domain remains ".example.com"
Do you guys have any hints on how I could change the cookie domain?

Use the cookie domain "none"
This will set a host-only cookie which will not be sent for all subdomains. Except in IE.
See the localhost example here:
https://developers.google.com/analytics/devguides/collection/analyticsjs/domains

Related

What are valid values for the domain attribute of a cookie?

I can't find any good source that exlains what valid values for the domain attribute of a cookie are when it gets set. They all just explain where cookies set for domain x are sent to. But I want to know
is www.example.com allowed to set a cookie with Domain example.com?
is example.com allowed to set a cookie with Domain www.example.com?
is www.example.com allowed to set a cookie with Domain www2.example.com?
is example.com allowed to set a cookie with Domain example.org?
is example.com allowed to set a cookie with Domain com?
Is https://publicsuffix.org/ relevant here for the site context?
Thx

Can't set a cross subdomain cookie in Django

I'm trying to use a subdomain cross site cookie with django but I cannot get it, I am in a valid subdomain but it doesn't seems to be useful.
Thie is my conf:
SESSION_COOKIE_SAMESITE = 'None'
SESSION_COOKIE_DOMAIN = '.ngrok.io'
This is the headers from the browser:
But I get the message:
This set-cookie domain attribute was invalid with regards to the current host url
How can I do to make it work?
As says in this answer there is a newer specification for cookies (RFC 6265). The old specification can let you share a cookie sent it from a subdomain "sub.domain.com" or "domain.com" with domain=.domain.com to share between domains and subdomains, but the newer specification can let you share by domain and subdomain only if you sent the cookie from "domain.com" with SameSite=None and domain=domain.com

How to stop domain cookies being used for subdomains?

I have a setup with the following domains:
mydomain.com
www.mydomain.com
There is one problem (tested on Internet Explorer):
if some cookie is set for mydomain.com, this cookie is also effective for www.mydomain.com even if I set a cookie with the same name for www.mydomain.com.
More specific examople:
1) the user chooses his prefered language on website mydomain.com and I set the cookie usrlng=en
2) next day someone else uses the same computer, naviagtes to www.mydomain.com and chooses his language, and I set the usrlng=de. But Internet Explorer keeps sending both cookies usrlng=en and usrlng=de to the server (I see this in Fiddler)! Why is it sending the same cookie twice and not overriding 'usrlng' with the subdomain value?
At the same time I see that PHPSESSID is being overwritten correctly for the subdomain, there are no two PHPSESSID cookies being sent to the server.
How can I fix the usrlng cookie and make it work the same way as PHPSESSID works?
You can also set a different save_path for each... so they don't share the sessions.
PHP example:
$subdomain = array_shift(explode('.',$_SERVER['HTTP_HOST']));
ini_set('session.save_path','D:\website_sessions\'.$subdomain.'\');
ini_set('session.save_path','D:\website_sessions\'.$subdomain.'\');
PHP needs access to write in the sessions directory.
For now I solved the problem by setting the 'host' of the cookie instead of 'domain'; 'host' property allowed to limit the cookie to mydomain.com or www.mydomain.com.
Maybe that is the only way to go and 'domain' cannot be set up to oveeride top level domain cookies.

setting cookie from subdomain that includes main domain for google analytics

Main site - www.example.com
App site - app.example.com
The cookie is created on app.example.com, but should also work for www.example.com.
setcookie("gacookie", time(), time()+31536000, '/');
Is this possible? What would be the code?
The cookie is being used to create a filter for GA that will exclude all current members of my application. The cookie is set the first time they log in. Both the main domain and the subdomain use the same GA tracking code.
Also, if another site that I visit has a cookie with the string "gacookie", will that effect the Google Analytics filter, or will it only ready cookies from the domain and subdomain it is tracking...
Here are more details on how to integrate tracking across sub/domains.
http://code.google.com/apis/analytics/docs/tracking/gaTrackingSite.html

Is it possible to read a cookie from a different sub-domain? If so, how?

I'm currently doing development on a site for a client. This site will be hosted on a subdomain of the client's main site. The client's main site is
www.xyz.com
and the site I'm working on will be hosted at
funds.xyz.com
Anyone who visits www.xyz.com will have a cookie written to their machine which contains data specifying the user's region. I need that data on my site. Is it possible for me to get access to this cookie?
Yes, so long as the cookie is set for domain ".xyz.com" (note the leading "."). This makes the cookie available to all subdomains of xyz.com
On the other hand, if the domain is "www.xyz.com", the cookie is only visible to the www subdomain.
I believe if you create a cookie with domain name: .xyz.com it will be accessible across all sub domains.