spring-session-core/src/main/java/org/springframework/session/web/http/DefaultCookieSerializer.java
public void setDomainNamePattern(String domainNamePattern) {
		if (this.domainName != null) {
			throw new IllegalStateException(
					"Cannot set both domainName and domainNamePattern");
		}
		this.domainNamePattern = Pattern.compile(domainNamePattern,
				Pattern.CASE_INSENSITIVE);
	}
public void setDomainNamePattern(String domainNamePattern) {
		if (this.domainName != null) {
			throw new IllegalStateException(
					"Cannot set both domainName and domainNamePattern");
		}
		this.domainNamePattern = Pattern.compile(domainNamePattern,
				Pattern.CASE_INSENSITIVE);
	}
<p>
Sets a case insensitive pattern used to extract the domain name from the
{@link HttpServletRequest#getServerName()}. The pattern should provide a single
grouping that defines what the value is that should be matched. User's should be
careful not to output malicious characters like new lines to prevent from things
like <a href= "https://www.owasp.org/index.php/HTTP_Response_Splitting">HTTP
Response Splitting</a>.
</p>

<p>
If the pattern does not match, then no domain will be set. This is useful to ensure
the domain is not set during development when localhost might be used.
</p>
<p>
An example value might be "^.+?\\.(\\w+\\.[a-z]+)$". For the given input, it would
provide the following explicit domain (null means no domain name is set):
</p>

<ul>
<li>example.com - null</li>
<li>child.sub.example.com - example.com</li>
<li>localhost - null</li>
<li>127.0.1.1 - null</li>
</ul>

@param domainNamePattern the case insensitive pattern to extract the domain name
with
@throws IllegalStateException if the domainName is also set