why doesn't cfcookie allow setting domain= to a subdomain for CFID/CFTOKEN?

Question

<cfcookie name="CFID" value="#session.cfid#" domain=".demo.labs.dev">

yields:

Set-Cookie: CFID=4215; Domain=.labs.dev; Expires=Sat, 04-Jul-2043 01:43:49 GMT; Path=/; HttpOnly

But if I use <cfheader> directly:

<cfheader name="Set-Cookie"
      value="CFID=4212; Domain=.demo.labs.dev; Expires=Sat, 04-Jul-2043 01:37:03 GMT; Path=/; HttpOnly">

yields:

Set-Cookie: CFID=4212; Domain=.demo.labs.dev; Expires=Sat, 04-Jul-2043 01:37:03 GMT; Path=/; HttpOnly

And that's really what I want.

Why does <cfcookie> behave this way? Current workaround would be using <cfheader> instead.

Answer 1

Have you reproduced this error with a leading . in the domain value? According to CF8, CF9 and CF10 docs, the domain attribute value Must start with a period..