# Session Cookie & Domains

**URL:** <https://www.ruby-forum.com/t/session-cookie-domains/89183>\
**Category:** Rails\
**Created:** [March 18, 2007, 8:04am UTC](https://www.ruby-forum.com/t/session-cookie-domains/89183 "2007-03-18T08:04:46Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![robertjames](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/e9c0ed/32.png) [@robertjames](https://www.ruby-forum.com/u/robertjames)\
**Post date:** [March 18, 2007, 8:04am UTC](https://www.ruby-forum.com/t/session-cookie-domains/89183/1 "2007-03-18T08:04:46Z")

</div>

Is there a way to tell Rails to always use the full domain for the  
session cookie? This is necessary if you want to allow people to be  
logged in to both [app1.mysite.com](http://app1.mysite.com) and [app2.mysite.com](http://app2.mysite.com) with separate  
sessions.

---

<div class="post-metadata">

**Author:** ![robertjames](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/e9c0ed/32.png) [@robertjames](https://www.ruby-forum.com/u/robertjames)\
**Post date:** [March 18, 2007, 1:40pm UTC](https://www.ruby-forum.com/t/session-cookie-domains/89183/2 "2007-03-18T13:40:17Z")

</div>

On 3/18/07, S. Robert J. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Is there a way to tell Rails to always use the full domain for the  
> session cookie? This is necessary if you want to allow people to be  
> logged in to both [app1.mysite.com](http://app1.mysite.com) and [app2.mysite.com](http://app2.mysite.com) with separate  
> sessions.

Use the session class method in your controller to set session options:  
[http://api.rubyonrails.org/classes/ActionController/SessionManagement/ClassMethods.html#M000128](http://api.rubyonrails.org/classes/ActionController/SessionManagement/ClassMethods.html#M000128)

The options are described here:  
[http://api.rubyonrails.org/classes/ActionController/Base.html#M000275](http://api.rubyonrails.org/classes/ActionController/Base.html#M000275)

So, in ApplicationController:  
session :session\_domain =\> ‘[mysite.com](http://mysite.com)’

Note that after 1.2 the main session settings are moving to  
environment.rb, with the same syntax:  
config.action\_controller.session = { :session\_domain =\> ‘[mysite.com](http://mysite.com)’ }

jeremy

---

<div class="post-metadata">

**Author:** ![robertjames](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/e9c0ed/32.png) [@robertjames](https://www.ruby-forum.com/u/robertjames)\
**Post date:** [March 18, 2007, 5:22pm UTC](https://www.ruby-forum.com/t/session-cookie-domains/89183/3 "2007-03-18T17:22:46Z")

</div>

On 3/18/07, S. Robert J. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Sorry for not being more clear:  
> The app can be running under numerous domains, not known while I  
> code. I don’t want to hard code them in - I just want to tell Rails -  
> whatever the Host: header is, use that for the cookie domain.

That’s the default. Have you tried it?

jeremy

---

<div class="post-metadata">

**Author:** ![robertjames](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/e9c0ed/32.png) [@robertjames](https://www.ruby-forum.com/u/robertjames)\
**Post date:** [March 18, 2007, 5:36pm UTC](https://www.ruby-forum.com/t/session-cookie-domains/89183/4 "2007-03-18T17:36:47Z")

</div>

Thanks - I was getting weird behavior and thought therefore that this  
was not set properly. But I traced the behavior to something else.  
(Sometimes getting confirmation of where the problem is NOT helps you  
think of where the problem IS… 🙂

---

<div class="post-metadata">

**Author:** ![robertjames](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/e9c0ed/32.png) [@robertjames](https://www.ruby-forum.com/u/robertjames)\
**Post date:** [March 18, 2007, 10:23pm UTC](https://www.ruby-forum.com/t/session-cookie-domains/89183/5 "2007-03-18T22:23:20Z")

</div>

If you want a cookie to apply to multiple subdomains, set the cookie  
domain a “.mydomain.com”. Note the initial “.”. See RFC 2109.

Note that the rfc states that the domain must have at least two dots.  
So, “.localhost” will not be the same cookie for test1.localhost and  
test2.localhost.

b

---

<div class="post-metadata">

**Author:** ![robertjames](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/e9c0ed/32.png) [@robertjames](https://www.ruby-forum.com/u/robertjames)\
**Post date:** [March 18, 2007, 4:59pm UTC](https://www.ruby-forum.com/t/session-cookie-domains/89183/6 "2007-03-18T16:59:39Z")

</div>

Sorry for not being more clear:  
The app can be running under numerous domains, not known while I  
code. I don’t want to hard code them in - I just want to tell Rails -  
whatever the Host: header is, use that for the cookie domain.