Cookie is not include across subdomains

[t03r1cht]

Hi everyone, quick question about the cookies. I try to access aws.domain.com/otherworld which is protected by Oathkeeper. Ory Cloud is supposed to handle authentication and is running under the custom domain ory.domain.com.

So, I attempt to access said protected resource and since I'm unauthorized, I get redirected to ory.domain.com for authentication. After successful authentication, Kratos from Ory Cloud issues me a Session cookie ory_session_... which is issues for .domain.com with cookie Path /.

When I'm attempting to access the protected resource on a different subdomain again, the Session cookie ory_session_... is not included, although it was issued for all subdomains.

I did not find anything helpful in the docs yet, but to me, it seems like a trivial problem because that should be a very common use case.

[aeneasr]

Hey @t03r1cht - sorry that this slipped through the cracks! Is it still an issue for this?

[t03r1cht]

Yes, it has been resolved. The problem was on my end. The cookie was issued with the Secure flag which required HTTPS for the cookie to be included, but at that time I was requesting the subdomain on plain HTTP. Setting up TLS resolved that issue for me!

[aeneasr]

Awesome!