Help with Multi Domain Sessions

• Setup
  • Environment: Laravel 5.5
  • Core Domain: www.example.com
  • SubSite: yyy.example.com
  • Sessions: database

The subsite and core site use the same Laravel install. We set up additional routes in the RouteServiceProvider for the subsite and everything is working correctly there. There are no issues with the sites being served or the functionality of the sites. They do share the exact same .env file as they are part of the same network of sites.

We are attempting to allow login on either site and access to the "authed" portion of both sites. Both sites share the same authed section that operates exactly the site. Just they are accessed differently via URL and have a slightly different look due to style sheets loaded in the layout.

Currently, the SESSION_DOMAIN in the .env file is set www.example.com. This allows login on www.example.com but not on yyy.example.com. yyy.example.com gives a 419 error due to the CRSF session cookie is not set because of the SESSION_DOMAIN I am guessing.

We tried to change SESSION_DOMAIN to .example.com but we can't log in on www.example.com. It redirects just fine after the auth occurs, but then no session exists when the page is rendered after the redirect.

We have also tried to change the SESSION_COOKIE value each time as to try an generate a new cookie name but all attempts have failed. We tried to clear the browser cache, all cookies, change browsers. It seems nothing is working for allowing the session to work on both subdomains.

It is difficult to do long periods of testing as www.example.com is a production site with ALOT of traffic. The site generates a lot of revenue, so users not being able to log in and purchase items is bad. yyy.example.com is not a critical as it's a new site we can coming out with.

Any help, suggestions, pointers, etc would be greatly appreciated.

Thanks, Matt