How to share cookie between domain and subdomain, but not other subdomains

Question

Our ASP.NET MVC web application has a few different subdomains we use for testing and legacy code. The subdomains are:

www.sitename.com (production site)
test.sitename.com (testing)
original.sitename.com (legacy code)
staging.sitename.com (occasionally used to testing right before a deployment)

We purposefully have the forms authentication not using domain level cookies because we want the cookies to be unique across these different subdomains. The problem is, when people get a link to the root domain (sitename.com), it requires them to log in again to get a cookie, even though they're already logged in to www.sitename.com.

Is there a way to share the cookie between only www.sitename.com and sitename.com without the other subdomains being affected?

you can redirect all sitename.com to www.sitename.com or vice versa to not to have this kind of problem. — Ergun Ozyurt, Apr 24 '16 at 20:14

score 6 · Answer 1 · answered Apr 24 '16 at 20:36

6

You can avoid this problem by redirecting your non www domain to www with UrlRewrite module in >IIS7

rewrite rule to put into web.config

<system.webServer>
<rewrite>
    <rules>
      <rule name="Redirect to WWW" stopProcessing="true">
        <match url=".*" />
        <conditions>
          <add input="{HTTP_HOST}" pattern="^example.com$" />
        </conditions>
        <action type="Redirect" url="http://www.example.com/{R:0}"
             redirectType="Permanent" />
      </rule>
        </rules>
    </rewrite>
</system.webServer>

answered Apr 24 '16 at 20:36

Ergun Ozyurt

512
3
17

Forgive me if this is a stupid question, but won't `pattern="^example.com$"` pick up, for instance, test.example.com? – Jacob Stamm Apr 24 '16 at 20:59
"www" is an another subdomain and not different than test.example.com for this pattern. the pattern is correct for non subdomain address which is only "example.com" – Ergun Ozyurt Apr 25 '16 at 06:08

Sean · Accepted Answer · 2019-04-26T15:07:22.180

I'd recommend forcing the use of the www. version of the site, for this reason amongst others, this site has excellent reasons why...

http://www.yes-www.org/why-use-www/

To do this in .net you can add the following to your web.config

<system.webServer>
  <rewrite>
    <rules>
      <rule name="Redirect to www" stopProcessing="true">
        <match url="(.*)" />
        <conditions trackAllCaptures="false">
        <add input="{HTTP_HOST}" pattern="^sitename.com$" />
        </conditions>
        <action type="Redirect" url="{MapProtocol:{HTTPS}}://www.{HTTP_HOST}{HTTP_URL}" redirectType="Permanent"/>
      </rule>
    </rules>
    <rewriteMaps>
      <rewriteMap name="MapProtocol">
        <add key="on" value="https" />
        <add key="off" value="http" />
      </rewriteMap>
    </rewriteMaps>
  </rewrite>
</system.webServer>

This will auto-redirect permanently (see the addition of redirectType="Permanent") for non-www URLs to the www equivalent and retain the HTTP(s) protocol.

The trackAllCaptures part is related to the regex pattern matching - in our case we do not need to capture anything; we only need to match for the rule, so we can leave as false.

The regex pattern ^sitename.com$ will match when the hostname matches exactly to "sitename.com" - the ^ means the start position and the $ means the end position

The rewrite map is from an idea from Jeff Graves I believe, http://jeffgraves.me/2012/11/06/maintain-protocol-in-url-rewrite-rules/

The way I have shown shows just one way to do this, like with most things - there are multiple ways on achieving this.

Scott Forsyth has an article on a different way of achieving this too (also references Jeff Graves) http://weblogs.asp.net/owscott/url-rewrite-protocol-http-https-in-the-action

I notice that your answer differs from Ergun's in that your condition node has `trackAllCaptures="false"`. What's that all about? — Jacob Stamm, Apr 24 '16 at 21:01
trackAllCaptures is used for the regex to define whether the matching string should be included in the results indexes - you can find more details about it here http://www.iis.net/learn/extensions/url-rewrite-module/url-rewrite-module-20-configuration-reference#Using_back-references_in_rewrite_rules - we're only matching for the host name and are not interesting in capturing anything so we can leave it as false — Sean, Apr 25 '16 at 06:50

score -1 · Answer 3 · answered Apr 27 '16 at 11:02

-1

You can use some thing like

sessionCookie.Domain = ".yourdomain.com" ;

then you will be able to request same cookies from any subdomain and edit it if you want.

answered Apr 27 '16 at 11:02

Dii

147
13

2

The answer is specifically asking for a way to not share the cookie across all subdomains, but only specific ones. – ArcSine May 01 '16 at 19:54

How to share cookie between domain and subdomain, but not other subdomains

3 Answers3