CodeParkDomain can only widen a cookie's scope to subdomains, and Path limits which paths get it. A server cannot set cookies for unrelated domains or public suffixes. Here is how each works for a cookie set by api.shop.com.
Without Domain: the cookie is host-only. The browser sends it back only to api.shop.com. It does not send it to shop.com or to other subdomains.
With Domain=shop.com: the browser sends it to shop.com and to every subdomain, such as www.shop.com and admin.shop.com. So setting Domain widens the scope. It never narrows it.
What a server cannot do. A server can only set Domain to its own host or a parent domain. api.shop.com cannot set a cookie for other.com. Browsers also reject cookies for public suffixes. A public suffix is a domain anyone can register under, like com or github.io.
Path limits which request paths carry the cookie, for example Path=/admin. It is not a security boundary. Pages on other paths of the same origin can still reach those cookies through scripts. If you need real isolation, use separate hosts.
- Without Domain, the cookie is host-only.
- With Domain set, the cookie also goes to all subdomains.
- A server cannot set cookies for unrelated domains or public suffixes.
- Path narrows which requests carry the cookie, but it is not a security boundary.