when you set a cookie, by default it sets it at the sub-domain level. You can opt-into setting it at a parent sub-domain (or the root-domain) level if you want.

So for example:

a.foo.com sets cookie X (Set-Cookie: X=value;)

a.foo.com sets a cookie Y on foo.com (Set-Cookie: Y=value; domain=foo.com)

b.foo.com can read Y, but can not read X