Yes, the subdomain can set / release a cookie for the main domain, but the main domain cannot set / release a cookie for the subdomain. See RFC 6265 Sections 5.1.3 , 5.3 (see clause 6) and 8.6 . Section 8.6 specifically describes how a subdomain can set a cookie for the primary domain and affect the subobject of the child node.
Remy Lebeau
source share