I am using Fetch API with {credentials:"include"} for requests described down bellow.

Also my HTTP server returning Access-Control-Allow-Credentials: true header.

I have a 3 domains:

1. example.com
2. application.example.com
3. server.example.com

🍪 server.example.com/sign-in will send a cookie key with Domain=example.com; HttpOnly=true; Path=/. The key is a encoded string with all possible permissions included.

As I found out the key is accessible from every single subdomain which is good. So application subdomain have key as well.

🍪 But application.example.com/test will send a cookie key with Domain=application.example.com; HttpOnly=true; Path=/test which is a key with ->limited<- permissions included.

So the cookies for subdomain application looks like:

The problem

The problem starts when I am trying to request server.example.com from application.example.com. The first cookie (wildcard) is used. But why? I am on application subdomain and also I have more relevant (the second) cookie.