diff --git a/auth_ssl_redirect.module b/auth_ssl_redirect.module
index 568532d..ca36024 100644
--- a/auth_ssl_redirect.module
+++ b/auth_ssl_redirect.module
@@ -76,18 +76,28 @@ function _auth_ssl_redirect_cookie_domain() {
     $domain = $cookie_domain;
   }
   elseif (!empty($_SERVER['HTTP_HOST'])) {
-    $cookie_domain = $_SERVER['HTTP_HOST'];
+    // This section is unlikely to be called, because
+    // drupal_settings_initialize() has already done identical processing
+    $domain = $_SERVER['HTTP_HOST'];
     // Strip leading periods, www., and port numbers from cookie domain.
-    $cookie_domain = ltrim($cookie_domain, '.');
-    if (strpos($cookie_domain, 'www.') === 0) {
-      $cookie_domain = substr($cookie_domain, 4);
+    $domain = ltrim($domain, '.');
+    if (strpos($domain, 'www.') === 0) {
+      $domain = substr($domain, 4);
     }
-    $cookie_domain = explode(':', $cookie_domain);
-    $domain = $cookie_domain[0];
+    $domain = explode(':', $domain);
+    $domain = $domain[0];
   }
   // Force cookie to have leading period to support subdomains.
   if (!empty($domain)) {
     $domain = '.' . ltrim($domain, '.');
   }
+
+  // Per RFC 2109, cookie domains must contain at least one dot other than the
+  // first. For hosts such as 'localhost' or IP Addresses we don't set a cookie domain
+  // (using blank value causes setcookie() to use default)
+  if (count(explode('.', $domain)) <= 2 || is_numeric(str_replace('.', '', $domain))) {
+    $domain = '';
+  }
+
   return $domain;
 }
\ No newline at end of file