Cookie documentation

[simon-friedberger]

The documentation claims that cookies cannot be set on public suffixes but that is simply not true.

Host cookies (__Host- or simply no domain=...) always work.

Domain cookies (with e.g. domain=example.com) automatically degrade to host cookies by having their domain string reset as specified in https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-15#section-5.7-3.9.1 and variations thereof.

[simon-friedberger]

@wdhdev @groundcat Does one of you maybe want to take this?

[wdhdev]

I'm not super aware of all the technical aspects around cookies, so I likely can't. I could give it a go though.

[groundcat]

I have just opened publicsuffix/publicsuffix.org#46, but I am wondering if there are any other inaccuracies in other parts of the documentation. I did not find any explicit documentation stating that "cookies cannot be set on public suffixes" - though I might have missed it!

cc @wdhdev