Subdomain Problem

I'm attempting to get the Cookie Authentication working and I'm having a problem which I believe is due to the cookie being set in the root domain of my website (www.site.com) and CS residing in a sub domain (community.site.com). How can I make the cookie authentication working? I have the correct cookie details set in the communityserver.config file so I believe it's just a matter of getting CS to read the cookie from the other domain!

 

If anyone know how to fix this please, please, let me know! Thanks.
 

• Filed under: Cookie Authentication Subdomain |
• Post Points: 20 |

The issue is that you're not *quite* creating the cookie at the root or your domain.  We never think of www as a subdomain, but it actually is, at least from the perspective of a browser when it's deciding what cookies to send with the request.   http://site.com is the real root of the domain, and www.site.com and community.site.com are just peer subdomains.

The good news is, cookies provide for this.   When you create your cookie under the www subdomain, if you set its "Domain" property to scope the cookie for the entire domain, like this"  ".site.com" the browser will know to send it along with any request to either the root site or any subdomain of the root site. 
 

Hope this helps,

Xander
 

• Post Points: 20 |

What about if a company has web sites running on different domains and want to share authentication. E.G company.com and company-region.com?

is this possible with the Cookie Authentication Add-on ?

• Filed under: cookie authentication |
• Post Points: 20 |

Can someone from CommunityServer Staff answer this thread. I have the same issue.

I purchased 1 License yesterday and it doesn't seem to work for me.

Thanks,

• Post Points: 20 |

What is your situation specifically?   If it's the same as jhillis', then my answer earlier in the thread applies.   If however, it's the situation mrtobias found himself in, then no, unfortunately, cookies are not capable of being scoped across domains.   The spec doesn't allow it for security reasons.

Hope this helps,

Xander 

• Post Points: 20 |

I have recently been working on a cross-site (sub.domain.com, sub2.domain.com and www.domain.com)  Cookie  Authentication implementation, and have found that rooting the Domain at 'domain.com'  solved all of my problems.  Just to  verify that Xanderno's suggestions do work --  however, due to security  built into most browsers, you can not post cookies from domain1.com to domain2.com

• Post Points: 5 |