in src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java [832:844]
private boolean isValidCookieDomain(HttpServletRequest request, String cookieDomain) {
boolean valid = false;
if (cookieDomain == null) {
valid = true;
} else {
// a valid cookie domain must be a suffix of the host
String host = request.getServerName();
if (host.endsWith(cookieDomain)) {
valid = true;
}
}
return valid;
}