11

Hit a roadblock while implementing a sub domain based language switcher (en.domain.com loads English, jp.domain.com loads Japanese).

How do I get a single membership system to work across multiple sub domains (ASP.NET MVC C#)?

Saw something about adding domain="domain.com" to <forms > entry in web.config. Did that, but does that work when testing on local visual studio development web server?

1

3 Answers 3

8

Try creating the cookie yourself.

In AccountController you'll find this:

FormsAuthentication.SetAuthCookie(userName, createPersistentCookie);

that "creates and adds to the cookie collection". It doesn't allow modification of the domain (but does allow modification of the path, oddly). Instead create a cookie without adding to the collection, modify the necessary properties, then add to the collection:

var a = FormsAuthentication.GetAuthCookie(userName, createPersistentCookie);
//if you're debugging right here, a.Domain should be en.example.com; change it
a.Domain = "example.com";
HttpContext.Current.Response.Cookies.Add(a);

James

2
  • Excellent idea... although I've already decided to scrap using sub-domains for language choice, this is one to remember. Thank you!
    – Chaddeus
    Jul 25, 2009 at 15:31
  • This didn't work for me. I'm using EF6 MVC 4... do you have any tips plz?
    – ilans
    Oct 24, 2014 at 8:56
4

You have to use dot prefix, like this.

<authentication mode="Forms">
    <forms domain=".tv.loc" loginUrl="~/signin" timeout="2880" name="auth" />
</authentication>
2
  • 1
    also, this only works for 2nd level domains or higher, i.e. .mydomain doesnt work, but .mydomain.com will Nov 17, 2010 at 15:19
  • does it work for "localhost"? i.e. for debugging in VS? Also is it required to set the domain in the form tag if you are setting the domain in the cookie?
    – Rahatur
    Jun 8, 2012 at 12:30
0

Your problem is how browsers sends cookie during request.

Cookie is generally tied to a single domain, this is for security reasons and performance. For example, user don't want to send cookie for your domain to any other domain, because your cookie may contain sensitive information.

Browser do differentiate between cookies set with en.domain.com and jp.domain.com. They do not allow cookies from one domain goes to the other because they are not on a parent domain.

The solution to your problem would be to take over the control of generating cookies. I haven't played much with ASP.NET MVC, but I'm sure it can be done not through the HTML but through a property or something. This is a very common scenario. You should set the cookies domain to "domain.com" for your production boxes, that is correct. If you're working on a local box, you should set the cookies domain to "".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.