Package org.asynchttpclient.cookie

Class PublicSuffixList

  • public final class PublicSuffixList
extends Object
    The Mozilla Public Suffix List, used to decide whether a cookie Domain attribute names a registry rather than a site.

    RFC 6265 Section 5.3 step 5 requires rejecting a Domain that is a public suffix, and that rule cannot be approximated: co.uk has a dot like any ordinary domain, so counting labels does not distinguish a registry from a site. Without the list a host under co.uk can set a cookie for co.uk itself and every other host under that suffix receives it.

    Both sections are bundled. The private one lists hosts such as github.io whose subdomains belong to different people, which is the same hazard.

    Internationalised rules are matched as written and as A-labels, since only the A-label gets past the cookie decoder. Matching lowercases with Locale.ROOT, and callers must fold the same way: under Turkish, "INFO".toLowerCase() is not info.

    The list is data and goes stale as registries change. If it cannot be read, only single-label names are treated as public suffixes, and the warning logged at load says so.

    • Method Detail

      • isPublicSuffix

        public static boolean isPublicSuffix​(String domain)
        Whether domain is a public suffix, and so may not be the Domain of a cookie.
        Parameters:
        domain - a hostname, without a leading dot