Prevent Cookie Sharing across sub-domains

Is there a way to prevent the cookie sharing on subdomains

Following is my session cookie domain

DJANGO_COOKIE_DOMAIN=.dev.fox.com

and my set_cookie() method sets the cookie even for subdomains like e.g: abc.fox.dev.com.

NOTE: I am getting this token via Firebase authentication.

I want to create an isolation , that if a user is logged in on app.dev.fox.com , cookies must be set on app.dev , but unfortunately it is set on all domains ending on .dev.fox.com

how to prevent this ?

Remove the dot prefix, so:

#        no leading dot 🖟
DJANGO_COOKIE_DOMAIN = 'dev.fox.com'

so if your host runs on app.fox.dev.com, use:

#        no leading dot 🖟
DJANGO_COOKIE_DOMAIN = 'app.dev.fox.com'
Back to Top