This is usefull, many thanks! Im building Keenrig, a self-shoting opensource app that gives users subdomains for their app, and your comment made me take another look at this. because some cookie issue . I'm moving user apps off my main domain (keenrig.com) onto a separate one - keenrig.app. the main reason is isolation: an app on a user subdomain shouldn't be able to set cookies for my console, or for other user'apps. many thanks