Cookie.java Removing a leading dot from cookie domain makes it unable to be used for subdomains

https://github.com/square/okhttp/blob/59e70dad8193ad5f8cd79749fc00be7dcf0308d1/okhttp/src/main/java/okhttp3/Cookie.java#L421

On this line the leading dot of the cookie domain is removed permanently, and we are unable to see if the cookie should be used on subdomains. Example: I perform a request for www.site.com/login. In response it returns me Set-Cookie with domain=.site.com. After parsing, cookie is stored with a domain site.com, which makes it non-usable even for www.site.com AFAIK, it does not match cookie specification.

[metalurgus]

then it themes like Android SDK bug. I’ve opened this issue because I was trying to use JavaNetCookieJar, with a default CookieManager. And it will not use cookies for foo.example.com, if cookie domain was originally .example.com

[swankjesse]

The specs were revised and the leading dot was dropped as a feature. Today cookies whose domain is example.com will domain match foo.example.com dot or no dot. https://tools.ietf.org/html/rfc6265#section-4.1.2.3 https://tools.ietf.org/html/rfc6265#section-5.1.3