title: Cookies on localhost with explicit domain
body: <p>I must be missing some basic thing about cookies. On localhost, when I set a cookie on server side <em>and</em> specify the domain explicitly as localhost (or .localhost). the cookie does not seem to be accepted by some browsers.</p>
  
  <p><strong>Firefox 3.5:</strong> I checked the HTTP request in Firebug. What I see is:</p>
  
  <pre><code>Set-Cookie:
      name=value;
      domain=localhost;
      expires=Thu, 16-Jul-2009 21:25:05 GMT;
      path=/
  </code></pre>
  
  <p>or (when I set the domain to .localhost):</p>
  
  <pre><code>Set-Cookie:
      name=value;
      domain=.localhost;
      expires=Thu, 16-Jul-2009 21:25:05 GMT;
      path=/
  </code></pre>
  
  <p>In either case, the cookie is not stored.</p>
  
  <p><strong>IE8:</strong> I did not use any extra tool, but the cookie does not seem to be stored as well, because it’s not being sent back in subsequent requests.</p>
  
  <p><strong>Opera 9.64:</strong> Both localhost and .localhost <em>work</em>, but when I check the list of cookies in Preferences, the domain is set to localhost.local even though it’s listed under localhost (in the list grouping).</p>
  
  <p><strong>Safari 4:</strong> Both localhost and .localhost <em>work</em>, but they are always listed as .localhost in Preferences. On the other hand, a cookie without an explicit domain, it being shown as just localhost (no dot).</p>
  
  <p>What is the problem with localhost? Because of such a number of inconsistencies, there must be some special rules involving localhost. Also, it’s not completely clear to me why domains must be prefixed by a dot? RFC 2109 explicitly states that: </p>
  
  <blockquote>
    <p>The value for the Domain attribute
    contains no embedded dots or does not
    start with a dot.</p>
  </blockquote>
  
  <p>Why? The document indicates that it has to do something with security. I have to admit that I have not read the entire specification (may do it later), but it sounds a bit strange. Based on this, setting cookies on localhost would be impossible.</p>