title: Sharing ASP.NET cookies across sub-domains
body: <p>I have two sites, both on the same domain, but with different sub-domains.</p>
  <ul>
  <li><code>site1.mydomain.example</code></li>
  <li><code>site2.mydomain.example</code></li>
  </ul>
  <p>Once I'm authenticated on each, I look at the cookies included in subsequent request and they are identical for each site.</p>
  <p>However, if I log into the first site, and then navigate to the other, I expect my cookie from site 1 to be sent with the request to site2, but this is not the case. Here are the properties of my cookies.</p>
  <p>Logging into Site1, this cookie then exists</p>
  <pre><code>Name = MySite
  Domain =
  Has Keys = False
  HttpOnly = False
  Path = /
  Value = 1C41854066B03D8CC5679EA92DE1EF427DAC65D1BA0E672899E27C57245C1F0B7E93AB01B5563363AB4815A8F4BDE9D293FD261E03F8E60B8497ABBA964D8D315CCE1C8DD220C7176E21DC361935CF6
  Expires = 1/1/0001 12:00:00 AM
  </code></pre>
  <p>Logging into Site2, these cookies then exists.</p>
  <pre><code>Name = MySite
  Domain =
  Has Keys = False
  HttpOnly = False
  Path = /
  Value =    C8C69F87F993166C4D044D33F21ED96463D5E4EB41E1D986BF508DA0CBD5C2CA7D782F59F3BC96871108997E899FF7401C0D8615705BDB353B56C7E164D2302EE6731F41705016105AD99F4E0578ECD2
  Expires = 1/1/0001 12:00:00 AM
  </code></pre>
  <p>I've set the domain on each (doesn't show up in a request cookie as it's only needed on the client).
  I've made sure my Forms setting for each are identical
  I've made sure my machine key settings are the same in both web configs.</p>
  <p>I'm at a loss on why this isn't working. What is it that a cookie contains that the client will send it for one sub-domain and not the other when they are both using the same auth cookies so far as I can tell?</p>
  <p>Please comment if there is more info you'd like to see. I've been struggling with this for two days now. According to <a href="http://www.codeproject.com/KB/aspnet/SingleSignon.aspx" rel="nofollow noreferrer">this article</a> this should be working.</p>
  <p>code added</p>
  <p>Here is my config file setting for my authentication. This is used in both sites.</p>
  <pre><code>&lt;authentication mode=&quot;Forms&quot;&gt;
      &lt;forms loginUrl=&quot;~/Account/LogOn&quot;
         defaultUrl=&quot;~/Home/Index&quot;
         name=&quot;MySite&quot;
         protection=&quot;All&quot;
         path=&quot;/&quot;
         domain=&quot;mydomain.example&quot;
         enableCrossAppRedirects=&quot;true&quot;
         timeout=&quot;2880&quot;
  /&gt;
  </code></pre>
  <p>And here is my code to create the cookie in Site1.</p>
  <pre><code>//Add a cookie that the Site2 will use for Authentication
  var cookie = FormsAuthentication.GetAuthCookie(userName, true);
  cookie.Name = &quot;MySite&quot;;
  cookie.HttpOnly = false;
  cookie.Expires = DateTime.Now.AddHours(24);
  cookie.Domain = &quot;mydomain.example&quot;;
  HttpContext.Response.Cookies.Add(cookie);
  HttpContext.Response.Redirect(site2Url,true);
  </code></pre>
  <p><strong>UPDATE 2:</strong></p>
  <p>I noticed something strange while testing. When I add a cookie to the response for site1, it get's added to this directory...
  C:\Users\jreddy\AppData\Roaming\Microsoft\Windows\Cookies</p>
  <p>When I add a cookie to the response for site, it gets added to this directory...
  C:\Users\jreddy\AppData\Roaming\Microsoft\Windows\Cookies\Low</p>
  <p>That could be my problem. Could it be that one of my sites is included in the local intranet zone?</p>
  <p><strong>UPDATE 3:</strong> Problem found, solution unknown
  It seems that my problem has to do with my second site being part of the Local Intranet Zone. If I go to Site1 using Firefox it works, but I have to enter my Windows credentials. If I go thru IE, my credentials are picked up automatically, but the cookies can't be read by site2. I may ask this in another question.</p>