Subdomains and Cookie-Consent-Cookies, order of them and not working if "parent" domain uses cookieconsent too

[alxndr-w]

I've got a website project that uses cookieconsent for bar.example.org and foo.bar.example.org.

If I go to bar.example.org first and accept cc, then go to foo.bar.example.org and also accept cc, the consent banner will show up on every page reload of foo.bar.example.org

How can I solve this?

[orestbida]

Hmm, can you please provide a config. example?

The simplest way to avoid any issue is to use a different cookie name for each domain.

[orestbida]

Wait, there is actually a way to set a cookie on a specific domain/subdomain only, although this behaviour may be browser dependent.

Currently we are always setting the 'Domain' field inside the cookie. If we omit the 'Domain' field, then only the current domain will should be able to see the cookie.

cookieconsent/src/utils/cookies.js

Lines 267 to 268 in e627950

	if (elContains(hostname, '.'))
	cookieStr += '; Domain=' + domain;

If we comment this line, it should (in theory) fix the issue.

[alxndr-w]

Then I will go for the cookie name, it's simple and clever - I didn't think about it.

I didn't know about it until I found the "full featured example" here: https://cookieconsent.orestbida.com/essential/getting-started.html

Thanks!

[alxndr-w]

If we comment this line, it should (in theory) fix the issue.

We sent our answers in this discussion the same time. I will check that out

[orestbida]

I tried commenting the line and it seems to fix the issue between domain and subdomain (on chrome and firefox).

The simplest way to implement this new unofficial solution would be to just add a check:

if (elContains(hostname, '.') && domain)
    cookieStr += '; Domain=' + domain; 

then in your config. you could set the domain field to an empty string:

cookie: {
    name: 'cc_cookie',
    domain: ''
}

Nevertheless, changing the name of the cookie is the preferred way.

[alxndr-w]

@orestbida I guess there are scenarios, where this actually would be a feature. Asking for consent on example.org but also recognizing the consent on foo.example.org.

Additionally, I want to use cookieconsent twice (frontend + backend) so being able to rename cc_cookie to something else is quite handy, too.

Anyway, thank you for your quick response which might saved me hours. I really appreciate it.