The leading dot in cookie's domain setting shouldn't get emphasized.
Cookie prefix may cause login problem in some circumstances.
Although rare, installing two MyBB with default settings, with same relative path but under different levels of a same domain (a domain and a sub-domain w.r.t. the first one), may cause login credential mismatch (before 1.8.16) or authorization code mismatch (as of 1.8.16). Please refer to this help: https://community.mybb.com/thread-227679-post-1349235.html#pid1349235
Further, I think, in future release MyBB's default install script should remove the leading dot on cookie domain auto-detect and alert user about add cookie prefix if installing multiple mybb under sub-domains or just provide a random value for cookie prefix. I know Discuz! does the latter by setting a random cookie prefix.
Relevant docs: https://docs.mybb.com/1.8/development/cookies/ https://docs.mybb.com/1.8/faq/login-problems/
Points to refine:
References:
From https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie we know:
Domain=<domain-value>: Host to which the cookie will be sent.From https://tools.ietf.org/html/rfc6265#section-5.4 we know:
A more plain explanation: https://stackoverflow.com/a/4327214/6681141
Further, I think, in future release MyBB's default install script should remove the leading dot on cookie domain auto-detect and alert user about add cookie prefix if installing multiple mybb under sub-domains or just provide a random value for cookie prefix. I know Discuz! does the latter by setting a random cookie prefix.