# How do you create one session cookie for multiple subdomains

**URL:** <https://www.ruby-forum.com/t/how-do-you-create-one-session-cookie-for-multiple-subdomains/140926>\
**Category:** Rails\
**Created:** [June 19, 2008, 9:38pm UTC](https://www.ruby-forum.com/t/how-do-you-create-one-session-cookie-for-multiple-subdomains/140926 "2008-06-19T21:38:40Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![chrisolsen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c6cbf5/32.png) [@chrisolsen](https://www.ruby-forum.com/u/chrisolsen)\
**Post date:** [June 19, 2008, 9:38pm UTC](https://www.ruby-forum.com/t/how-do-you-create-one-session-cookie-for-multiple-subdomains/140926/1 "2008-06-19T21:38:40Z")

</div>

I am using the restful authentication plugin and am always prompted to  
login if a different subdomain is accessed. I have found a couple rails  
“solutions”, but none of them seem to work:

# development.rb

1. ActionController::CgiRequest::DEFAULT\_SESSION\_OPTIONS[:session\_key]  
= “.localhost”
2. ActionController::Base.session\_options[:key] = “.localhost”

Does anyone have a way that works?

Thanks

---

<div class="post-metadata">

**Author:** ![chrisolsen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c6cbf5/32.png) [@chrisolsen](https://www.ruby-forum.com/u/chrisolsen)\
**Post date:** [June 19, 2008, 9:54pm UTC](https://www.ruby-forum.com/t/how-do-you-create-one-session-cookie-for-multiple-subdomains/140926/2 "2008-06-19T21:54:55Z")

</div>

On 19 Jun 2008, at 20:38, Chris O. wrote:

> 1. ActionController::Base.session\_options[:key] = “.localhost”

config.action\_controller.session = {  
:session\_domain =\> ‘texperts.local’,  
…  
}

works for me. session\_key is the name of the cookie

Fred

---

<div class="post-metadata">

**Author:** ![chrisolsen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c6cbf5/32.png) [@chrisolsen](https://www.ruby-forum.com/u/chrisolsen)\
**Post date:** [June 19, 2008, 10:38pm UTC](https://www.ruby-forum.com/t/how-do-you-create-one-session-cookie-for-multiple-subdomains/140926/3 "2008-06-19T22:38:16Z")

</div>

Frederick C. wrote:

> config.action\_controller.session = {  
> :session\_domain =\> ‘texperts.local’,  
> …  
> }

After making the changes that you suggested I continually get  
InvalidAuthenticityToken exceptions. When I turned of  
protect\_from\_forgery I obviously never got the exceptions, but I was  
still unable to have one session key for more than one subdomain.

This is what I now have:  
config.action\_controller.session = {  
:session\_domain =\> “.local”,  
:session\_key =\> ‘\_app\_session’,  
:secret =\> ‘secret\_key’  
}

Is there anything that I am missing?

---

<div class="post-metadata">

**Author:** ![chrisolsen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c6cbf5/32.png) [@chrisolsen](https://www.ruby-forum.com/u/chrisolsen)\
**Post date:** [June 19, 2008, 11:23pm UTC](https://www.ruby-forum.com/t/how-do-you-create-one-session-cookie-for-multiple-subdomains/140926/4 "2008-06-19T23:23:28Z")

</div>

Frederick C. wrote:

> You can’t set cookies for a top level domain like .local (in the same  
> way that you can’t set a cookie for .com) the domain you set a cookie  
> for must have at least two components (there are a lot of  
> complications etc… see [The Opera Blog - News | Opera](http://my.opera.com/yngve/blog/show.dml/)  
> 267415 for example)
> 
> Fred

Thanks for the info Fred. Once I set up my hosts file to point  
myappname.localhost to the loopback address (along with some additional  
test subdomains) and made all test app requests to that url, it allowed  
the cookie to be shared nicely.

Thanks again.

---

<div class="post-metadata">

**Author:** ![chrisolsen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c6cbf5/32.png) [@chrisolsen](https://www.ruby-forum.com/u/chrisolsen)\
**Post date:** [June 19, 2008, 10:47pm UTC](https://www.ruby-forum.com/t/how-do-you-create-one-session-cookie-for-multiple-subdomains/140926/5 "2008-06-19T22:47:30Z")

</div>

On 19 Jun 2008, at 21:38, Chris O. wrote:

> still unable to have one session key for more than one subdomain.
> 
> This is what I now have:  
> config.action\_controller.session = {  
> :session\_domain =\> “.local”,  
> :session\_key =\> ‘\_app\_session’,  
> :secret =\> ‘secret\_key’  
> }
> 
> Is there anything that I am missing?

You can’t set cookies for a top level domain like .local (in the same  
way that you can’t set a cookie for .com) the domain you set a cookie  
for must have at least two components (there are a lot of  
complications etc… see [The Opera Blog - News | Opera](http://my.opera.com/yngve/blog/show.dml/)  
267415 for example)

Fred

---

<div class="post-metadata">

**Author:** ![chrisolsen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/c6cbf5/32.png) [@chrisolsen](https://www.ruby-forum.com/u/chrisolsen)\
**Post date:** [December 10, 2008, 5:32pm UTC](https://www.ruby-forum.com/t/how-do-you-create-one-session-cookie-for-multiple-subdomains/140926/6 "2008-12-10T17:32:02Z")

</div>

Chris O. wrote:

> Frederick C. wrote:
> 
> > You can’t set cookies for a top level domain like .local (in the same  
> > way that you can’t set a cookie for .com) the domain you set a cookie  
> > for must have at least two components (there are a lot of  
> > complications etc… see [The Opera Blog - News | Opera](http://my.opera.com/yngve/blog/show.dml/)  
> > 267415 for example)

In case anyone had the same issue – I was trying to get cross-subdomain  
cookies, as above. I followed the instructions… set my session\_domain  
to “.myapp.local” to get around the issue Fred mentions, added some  
aliases to /etc/hosts, cleared my cookies, tried to log in to my app.  
And I was still getting InvalidAuthenticityToken errors.

Turns out all I needed to do was restart Firefox. No idea why that  
worked, but the InvalidAuthenticityToken errors stopped.

ymmv of course.