Cross domain cookie access (or session)

Question

While I realise that this is usually related to cross site scripting attacks, what I'm wondering is how can a session remain valid throughout multiple subdomains belonging to a single domain (example: a user logging in only once, and being able to access both subdomain1.domain.com and subdomain2.domain.com with the same session). I guess I first need to understand how it works, but so far I haven't been able to find much that would be of any relevance. But then again, maybe I wasn't asking the right question. Thanks in advance :)

Accepted Answer

Inproc sessions cannot remain valid, however you can code your web application to allow cookies across multiple subdomains. You will need to set the domain equal to:

```
Response.Cookies("CookieName").Domain = ".mydomain.com"
```

Remember the period.

Cross domain cookie access (or session)

Solution

Problem