Hi Rick. Great article. I have doubt here. The browser attached cookies to the POST request initiating from subdomain inspite of the domain attribute being omitted. The cookies were never set but were attached to the request. I am looking for an explanation for this question. I am experiencing the same and its contradicting the purpose of the domain attribute.