Is it possible to configure Rails.application.config.session_store to share a cookie between two subdomains but exclude a third?

Viewed 114

I am using Rails 4.2.11.3. I would like to configure Rails to share a cookie between two subdomains but not a third. For example, I'd like to have a user be able to share a session between foo.example.com and bar.example.com, but have a separate session for bat.example.com.

The reason for this is that one of our clients has two subdomains and some users need to have access to both with a single sign on. Our company's admins need access to all subdomains, but sharing the cookie between all subdomains causes the cookie to overflow for those users.

I've tried the following:

Rails.application.config.session_store(
  :cookie_store,
  key: "_session",
  domain: [
    'foo.example.com',
    'bar.example.com'
  ]
)

But that seems to create a separate cookie for each domain. I don't understand how this is different from the default behavior. Am I missing something?

I know that domain: :all creates a cookie that's shared across all subdomains, but I want some subdomains to have their own cookie. Is this even possible?

0 Answers
Related