H
Thanks, Damiano, that's a useful extension. You're right that __Secure- still requires the Secure attribute and a secure origin but allows Domain, so a cookie scoped to the parent domain is sent to every subdomain and each one becomes part of the trust boundary. Checking for dangling DNS records on subdomains you no longer run is a good addition to that case.