What’s wrong with localhost? Why FQDN?

Jatinder Singh
Securing Digital Identity
1 min readNov 29, 2018

Long story short — it’s because of browser cookies.

OpenAM or AM relies on browser cookies which are returned based on the domain name that is configured for your OpenAM installation. Major browsers including Chrome, Firefox and IE stopped accepting browser cookies on localhost. This is mainly due to HTTP State Management Mechanism a.k.a HTTP Cookie specification. As per the spec, you can set the cookie domain name value to an empty string for host-only cookies or to any non-top level domain. For example, if you install AM and use am.sqoopdata.com as the host, you can set the cookie domain name as sqoopdata.com.

If the first character of the attribute-value string is %x2E (“.”):

Let cookie-domain be the attribute-value without the leading %x2E
(“.”) character.

Otherwise: Let cookie-domain be the entire attribute-value.

Also, important is to understand — you cannot set any Top-Level Domain (TLD) as your cookie domain as browsers like Chrome, Firefox and IE will reject it. For a list of ICANN TLDs, you can visit this link. And for production deployments, make sure the FQDN is properly assigned using DNS server.

Still having an issue? Please leave a comment.

--

--

Jatinder Singh
Jatinder Singh

Written by Jatinder Singh

Identity & Access Management Expert on ForgeRock platform. Certified AWS Solutions Architect.