I have a Blazor Interactive Server app that uses the ASP.NET Identity Library for Authentication & Authorization.
I have the app set up where you normally connect to it using connect.tradewindsstudios.us. However, it is an app showing events for political campaigns so I also allow connecting using MyCampaign.tradewindsstudios.us where the MyCampaign is a unique Id for a given campaign. It then only shows events for that campaign.
The problem is, if a user is logged in to connect.tradewindsstudios.us, they have to log in again to MyCampaign.tradewindsstudios.us. Is there a way to tell the Identity Library to tie the cookie identifying the logged in user to tradewindsstudios.us?
h/t to josephdecock who provided this:
services.ConfigureApplicationCookie(options =>
{
options.Cookie.Domain = ".conteso.com"; // can be dangerous
});
per Joseph:
There's a security risk that you should be aware of, which is that if you set the cookie domain to be the parent domain, browsers will send the cookies to ALL subdomains. The risk is that if some other subdomain is hacked, browsers will send session cookies to the attacker - imagine if you're running app1.example.com and app2.example.com, but there's also crappy-word-press-site.example.com that was set up by some marketing team 7 years ago, forgotten about, has never received any security patches and is now taken over by an attacker. Now if a user is logged on and goes to the vulnerable site, their session cookie will be disclosed to the attacker.