Cross subdomain cookie sharing issue

CHANGELOG.md

@@ -8,6 +8,7 @@
 
 ### Fixed
 
+- `CookiePlugin` allows main domain cookies to be sent/stored for subdomains
 - `DecoderPlugin` uses the right `FilteredStream` to handle `deflate` content encoding
 
 ## 1.4.1 - 2017-02-20

spec/Plugin/CookiePluginSpec.php

@@ -82,6 +82,41 @@ function it_does_not_load_cookie_if_domain_does_not_match(RequestInterface $requ
         }, function () {});
     }
 
+    function it_does_not_load_cookie_on_hackish_domains(RequestInterface $request, UriInterface $uri, Promise $promise)
+    {
+        $cookie = new Cookie('name', 'value', 86400, 'test.com');
+        $this->cookieJar->addCookie($cookie);
+
+        $request->getUri()->willReturn($uri);
+        $uri->getHost()->willReturn('hacktest.com');
+
+        $request->withAddedHeader('Cookie', 'name=value')->shouldNotBeCalled();
+
+        $this->handleRequest($request, function (RequestInterface $requestReceived) use ($request, $promise) {
+            if (Argument::is($requestReceived)->scoreArgument($request->getWrappedObject())) {
+                return $promise->getWrappedObject();
+            }
+        }, function () {});
+    }
+
+    function it_loads_cookie_on_subdomains(RequestInterface $request, UriInterface $uri, Promise $promise)
+    {
+        $cookie = new Cookie('name', 'value', 86400, 'test.com');
+        $this->cookieJar->addCookie($cookie);
+
+        $request->getUri()->willReturn($uri);
+        $uri->getHost()->willReturn('www.test.com');
+        $uri->getPath()->willReturn('/');
+
+        $request->withAddedHeader('Cookie', 'name=value')->willReturn($request);
+
+        $this->handleRequest($request, function (RequestInterface $requestReceived) use ($request, $promise) {
+            if (Argument::is($requestReceived)->scoreArgument($request->getWrappedObject())) {
+                return $promise->getWrappedObject();
+            }
+        }, function () {});
+    }
+
     function it_does_not_load_cookie_if_path_does_not_match(RequestInterface $request, UriInterface $uri, Promise $promise)
     {
         $cookie = new Cookie('name', 'value', 86400, 'test.com', '/sub');

src/Plugin/CookiePlugin.php

@@ -69,7 +69,11 @@ public function handleRequest(RequestInterface $request, callable $next, callabl
                     }
 
                     // Restrict setting cookie from another domain
-                    if (false === strpos($cookie->getDomain(), $request->getUri()->getHost())) {
+                    if (false === strpos(
+                            '.'.$request->getUri()->getHost(),
+                            '.'.$cookie->getDomain()
+                        )
+                    ) {
                         continue;
                     }