How can I share authentication cookies between two different domains ?

Browsers do not allow cookies to be shared across different top-level domains (e.g., example.com and example.net) due to security restrictions. Cookies can only be shared across subdomains (e.g., app.example.com and api.example.com) by setting the cookie domain to .example.com.

consider alternative approaches like:

Centralized authentication via OAuth/OpenID Connect
Token-based authentication (e.g., JWT) passed via headers
Using a shared identity provider (e.g., Azure AD B2C, Auth0)

If you're working with example.com and example.net, consider using JWT tokens:

Authenticate the user on one domain.
Issue a JWT token.
Pass the token via headers (e.g., Authorization: Bearer ) to the other domain.
Validate the token using shared secret or public key.

This approach is stateless, secure, and works across domains.

https://learn.microsoft.com/en-us/aspnet/core/security/cookie-sharing?view=aspnetcore-9.0

1 Reply

Know the answer? Post it — somebody with the same question will find it here.

Deepika Sawant1y ago
Browsers do not allow cookies to be shared across different top-level domains (e.g., example.com and example.net) due to security restrictions. Cookies can only be shared across subdomains (e.g., app.example.com and api.example.com) by setting the cookie domain to .example.com.

consider alternative approaches like:
- Centralized authentication via OAuth/OpenID Connect
- Token-based authentication (e.g., JWT) passed via headers
- Using a shared identity provider (e.g., Azure AD B2C, Auth0)
If you're working with example.com and example.net, consider using JWT tokens:
- Authenticate the user on one domain.
- Issue a JWT token.
- Pass the token via headers (e.g., Authorization: Bearer ) to the other domain.
- Validate the token using shared secret or public key.
This approach is stateless, secure, and works across domains.

https://learn.microsoft.com/en-us/aspnet/core/security/cookie-sharing?view=aspnetcore-9.0