[nerbert]

Originally Posted by kh99

Maybe, but it kind of seems like that would be a security risk, since you could easily write JS for your page that reads all cookies and sends them to your server.

Yes that seems to be the case. I looked at vBulletin's set_cookie() function and it does set the path to the default "/", so I wrote my own version that sets the path to "/nowhere.php". It successfully sets the cookie but my JS won't read it, and that doesn't seem to have anything to do with vBulletin's fetch_cookie() function, it seems to be built into the browser.

I don't really know what a request cookie is all about, I suppose you could compare the values sent with the values stored for some sort of security check. Somewhere vB specifies a cookie header (or fails to prevent a default one being sent). I have no idea how to change that.