Cookie set to IP number?

[filmo]

Is it possible to set a cookie to an IP number instead of the usual www.company.com? i.e.

-domain=>'.289.11.63.71'

it doesn't seem to work for me.

Originally posted as a Categorized Question.

[dws]

Is it possible to set a cookie to an IP number instead of the usual www.company.com?

You might be able to set the cookie (that is, get some browser to accept and store it), but no browser that I know of will actually return it to you. Where they to do so, it would introduce a massive security hole.

Think about it for a moment. It's possible to set a cookie for ".example.com" that will be returned by a browser for visits to "example.com", "www.example.com", or "a.b.c.example.com". But what of ".1.1"? That would match sites all over the place.

[mt2k]

You *can* set a cookie to an IP address.
You just cannot wildcard it! So while -domain=>'.289.11.63.71' is invalid, -domain=>'289.11.63.71' is not
(get rid of the period before the first set of numbers).

This has got to be allowed for one reason: what of servers that are located on a machine without a domain?
You have to be able to set cookies somehow!
Also, the only way to specify "subdomains" of an IP address is through port numbers.
It is apparently possible using HTTP::Cookie or the Set-Cookie2 header, but I have been unable to restrict a cookie to a specific port :(

[Fastolfe]

By default, a cookie's Domain becomes the hostname of the URI used to make the HTTP request in the first place. If you connect to a web server by IP address, and this web server sets a cookie without a Domain attribute, the cookie will be implicitly set with the Domain equal to the IP address of the web server.

You cannot specify an IP address in the Domain portion of the cookie. In the first place, it's useless in the case where the IP address matches the IP address in the URI. Secondly, IP addresses do not easily follow organizational boundaries in the way DNS domains do. An IP address with a number one less or one greater than the IP address of the web server may not necessarily reside in the same organization. For security reasons, then, any form of wild-carding of IP addresses in the Domain attribute of a cookie is not permitted. This effectively removes the usefulness of the Domain attribute for any form of IP address, aside from the implicit use mentioned above.