title: What cookies can a js script loaded from an external domain access?
body: <p>Assume a web app (served over http) has a  tag with a src that is another domain. The external script is doing things with cookies and/or localStorage. What domains cookies can it access? </p>
  
  <p><code>
  &lt;!-- on example.org --&gt;
  &lt;script src='http://anotherexample.org/script.js'&gt; &lt;!-- This script messes with cookies --&gt;
  </code></p>
  
  <p>My intuition tells me the the cookies that it manipulates are those that belong to example.org. But how does this work?</p>