Remove base domain cookies from a subdomain using Java filter
<p>I'm creating a Java filter hosted from domain <strong>test.example.com</strong> that will remove certain cookies based on their names (the list of banned cookie names are stored in the init configuration of the filter).</p>

<p>Now, I have cookies coming from another site which have domain attributes set to <strong>.example.com</strong>. Some of these cookies needs to be blocked/removed by the filter I'm developing.</p>

<p>I've read online articles including some stackoverflow posts related to cookie domain matching. I'm quite sure that these cookies having the domain attribute <strong>.example.com</strong> should be accessible from subdomain <strong>test.example.com</strong>. In fact, using debug I can verify that was able to access these cookies. However, I have problems removing them by invoking <code>setMaxAge(0)</code> and adding it back to the response via <code>addCookie</code>. It turns out that cookie is getting duplicated, instead of being deleted.</p>

<p>I wonder if it is ever possible to remove a cookie with a domain attribute <strong>.example.com</strong> (base domain) from <strong>test.example.com</strong> (subdomain). Or cookie deletion will only be possible if I'm executing my Java filter from the base domain only - which is <strong>example.com</strong>?</p>

<p>Here's a snippet of my code:</p>

<pre><code>if (cookieBlockList != null) {
    Cookie[] cookies = httpRequest.getCookies();
    for (int i=0; i &lt; cookies.length; i++) {
        String cookieName = cookies[i].getName();

        for(int j=0; j &lt; cookieBlockList.length; j++) {
            if (cookieName.equalsIgnoreCase(cookieBlockList[j])) {
                Cookie cookie = new Cookie(cookieName, "");
                cookie.setMaxAge(0);
                httpResponse.addCookie(cookies[i]);
            }
        }
    }
}
filterChain.doFilter(request, response);
</code></pre>