Looks like I mis-interpreted what's said in the codex. So, here's the thing...
This is what WordPress does by default:
define('COOKIE_DOMAIN', '.example.com'); — which means, cookies are sent with all the sub-domains, including
example.com itself, even if your WordPress website itself is hosted on
Basically the point is, when your WordPress site is served from
www.example.com, you can also have the cookies sent only with
www.example.com and not other sub-domains, by adding this in your wp-config.php:
So, at most, what the aforementioned code does is restrict the cookies to the sub-domain that serves your WP site.
NOTE: And just in case it's not clear -- it's pointless to use
define('COOKIE_DOMAIN', 'www.example.com'); when your site itself is served from
example.com or some other sub-domain, and not 'www.example.com'.