Description:
------------
The page http://php.net/manual/en/function.setcookie.php contains several references to RFC 2109. This has been obsoleted by RFC 6265 (published April 2011).

http://tools.ietf.org/html/rfc2109
http://tools.ietf.org/html/rfc6265

In particular, the manual page currently says:
> domain:
> The domain that the cookie is available to. To make the cookie available
> on all subdomains of example.com (including example.com itself) then you'd
> set it to '.example.com'. Although some browsers will accept cookies
> without the initial ., RFC 2109 requires it to be included. Setting the
> domain to 'www.example.com' or '.www.example.com' will make the cookie only
> available in the www subdomain.

The requirement about the leading period has been reverted, so now it is no longer permitted, though browsers are required to ignore any leading periods (section 4.1.2.3).


I don't know if any current browsers require the use of a leading period. RFC 6265 claims to be describe current practice, and says that "[w]here some existing software differs from the recommended protocol in significant ways, the document contains a note explaining the difference". There is no mention of browsers malfunctioning when the leading period is omitted.


- The manual page should be updated to refer to RFC 6265.
- The examples should not use a leading period for the domain argument.
- The description of the domain argument should be rephrased to reflect the updated RFC.