Looks like I mis-interpreted what's said in the codex. So, here's the thing...
This is what WordPress does by default: define('COOKIE_DOMAIN', '.example.com');
— which means, cookies are sent with all the sub-domains, including example.com
itself, even if your WordPress website itself is hosted on www.example.com
.
Basically the point is, when your WordPress site is served from www.example.com
, you can also have the cookies sent only with www.example.com
and not other sub-domains, by adding this in your wp-config.php:
define('COOKIE_DOMAIN', 'www.example.com');
So, at most, what the aforementioned code does is restrict the cookies to the sub-domain that serves your WP site.
NOTE: And just in case it's not clear -- it's pointless to use define('COOKIE_DOMAIN', 'www.example.com');
when your site itself is served from example.com
or some other sub-domain, and not 'www.example.com'.