I struggled with the best way to explain to the user that using CURLOPT_COOKIELIST and Set-Cookie without a domain means the cookie is used for any domain and will not be modified. The issue was brought up on the mailing list recently. I came up with some basic warning that I added just now in b18a165. But should Set-Cookie without a domain really mean that? It seems too late to change the behavior, so it should be documented.

Also it isn't yet documented that a cookie without a domain is saved with hostname "unknown" and I wonder if it should be. It seems they are not later loaded as any-domain cookies when they are imported. But also it's been like that for so long maybe some users expect that. However what's the goal of saving as unknown, because when you import it it's not like it's going to be used for all domains again. It might be fitting to warn the user of that as well. And what if someone actually has a hostname "unknown"?