diff --git a/core/lib/Drupal/Core/Session/SessionConfiguration.php b/core/lib/Drupal/Core/Session/SessionConfiguration.php
index ec98e0a..a96d6c1 100644
--- a/core/lib/Drupal/Core/Session/SessionConfiguration.php
+++ b/core/lib/Drupal/Core/Session/SessionConfiguration.php
@@ -35,6 +35,7 @@ class SessionConfiguration implements SessionConfigurationInterface {
    *   An associative array of session ini settings.
    *
    * @see \Symfony\Component\HttpFoundation\Session\Storage\NativeSessionStorage::__construct()
+   * @see http://php.net/manual/session.configuration.php
    */
   public function __construct($options = []) {
     $this->options = $options;
@@ -162,6 +163,13 @@ protected function getUnprefixedName(Request $request) {
   /**
    * Return the session cookie domain.
    *
+   * The Set-Cookie response header and its domain attribute are defined in RFC
+   * 2109, RFC 2965 and RFC 6265 each one superseeding the previous version.
+   *
+   * @see http://tools.ietf.org/html/rfc2109
+   * @see http://tools.ietf.org/html/rfc2965
+   * @see http://tools.ietf.org/html/rfc6265
+   *
    * @param \Symfony\Component\HttpFoundation\Request $request
    *   The request.
    *
@@ -179,12 +187,16 @@ protected function getCookieDomain(Request $request) {
       if (strpos($host, 'www.') === 0) {
         $host = substr($host, 4);
       }
+
+      // To maximize compatibility and normalize the behavior across user
+      // agents, the cookie domain should start with a dot.
       $cookie_domain = '.' . $host;
     }
 
-    // Per RFC 2109, cookie domains must contain at least one dot other than the
-    // first. For hosts such as 'localhost' or IP Addresses we don't set a
-    // cookie domain.
+    // Cookies for domains without an embedded dot will be rejected by user
+    // agents in order to defeat malicious websites attempting to set cookies
+    // for top-level domains. Also IP addresses may not be used in the domain
+    // attribute of a Set-Cookie header.
     if (count(explode('.', $cookie_domain)) > 2 && !is_numeric(str_replace('.', '', $cookie_domain))) {
       return $cookie_domain;
     }