IE sharing login cookie across subdomains - unwanted

1
votes

I have a login cookie for www.mysite.com and several sub-domains, eg.:

  • www.one.mysite.com
  • www.two.mysite.com
  • www.three.mysite.com

In IE only (firefox does not do this) if I log on in mysite.com, it appears as though that cookie is shared across all subdomains (logged in to all sites). If I log on using a subdomain (one.mysite.com), the cookie is not shared (only logged into one.mysite.com).

www.mysite.com and www.one.mysite.com share the same web.config file, and I don't mind them sharing a login cookie (it's the same site with a different url is all), but not across the rest of the sites.

How do I stop IE from sharing the cookie to all or some subdomains?

Can I do this just using the web.config file?

Update:

I'm using membership and role manager in my web.config file. In the above problem I have not set

<authentication mode="Forms"> <forms domain="...

As far as I can see, 

<authentication mode="Forms"> <forms domain="mysite.com" ...

can either allow only one domain (www.mysite.com), or all subdomains (.mysite.com). I need a way to allow www.mysite.com and one subdomain. Is this possible?

Can I tell the other subdomains not to accept the .mysite.com cookie?

2
asp.netinternet-explorercookiesweb-config
My gut says maybe you check/tested wrong. Try deleting cookies in firefox/IE and try again. But also what version of IE? 6,7,8 are drastically different (or so i hear) – user34537
Tested in both IE 8 & 9 with the same problem. Tested several times in several ways and the problem still persists as described. – user1314350

2 Answers

3
votes

Normally a cookie set on example.com will be accessed by all of the subdomains. However, if you want to limit the cookie to a specific subdomain, you should manually set the domain property for each domain you want them to access.

Response.Cookies["domain"].Domain = "www.example.com";

Some valuable reading, or More valuable reading... (read: "Limiting Cookie Domain Scope" section), and finally "How to limit cookie for a particular subdomain in ASP.NET"

0
votes

The answer is that I really have no idea what is going on with the login procedure here.

The other guy who I'm working with is fixing the problem. Apparently it has something to do with the machine key, which needs to be changed on all the other subdomain websites (two.mysite.com, three.mysite.com) except the main one (www.mysite.com).

This is hardly an answer, but if you're stupid like me (don't know enough about ASP.Net logins), and have to deal with IE8/compatibility view and this login problem... Well hopefully it will help someone who doesn't know where to look for an answer.