Forms Authentication across Sub-Domains on local IIS

Question

I know a cookie can be shared across multiple subdomains using the setting

<forms 
    name=".ASPXAUTH" 
    loginUrl="Login/" 
    protection="Validation" 
    timeout="120" 
    path="/"     
    domain=".mydomain.com"/>

in Web.config. But how to replicate same thing on local machine. I am using windows 7 and IIS 7 on my laptop. So I have sites localhost.users/ for my actual site users.mysite.com localhost.host/ for host.mysite.com and similar.

Darin Dimitrov · Accepted Answer · 2011-11-26T11:29:17.277

9

localhost.users and localhost.host is cross domain. Cookies cannot be shared cross domain.

You could configure it like this so that the sub-domain differs but the root domain stays the same:

users.localhost
host.localhost

Now set the cookie domain in your web.config to localhost:

domain=".localhost"

and in your c:\Windows\System32\drivers\etc\hosts file add the following 2 entries:

127.0.0.1 users.localhost
127.0.0.1 host.localhost

Now you will be able to successfully share the authentication cookie between users.localhost and host.localhost.

Ah, and don't forget to put a step in your automated build process that will transform your web.config value to the correct root domain before shipping in production.

edited Nov 26 '11 at 11:29

answered Nov 26 '11 at 11:14

Darin Dimitrov

1,023,142
271
3,287
2,928

Thanks Darin, How to set this up in IIS as I created these sites from visual studio. – Parminder Nov 26 '11 at 11:30
1

@Parminder, IIS configuration questions should be discussed on http://serverfault.com. – Darin Dimitrov Nov 26 '11 at 11:30
Darin, Thanks, I have asked this question there, but does it make sense to ask the same question at two differnt places. – Parminder Nov 26 '11 at 11:43

Serj Sagan · Answer 2 · 2013-11-27T01:37:51.650

3

This is a reminder for anyone running in Framework 4.5 and trying to share the token with frameworks 4 and lower, please notice that this will cause you not to receive the auth cookie on any of the 4 and lower apps. ie: if in your web.config you have:

<httpRuntime maxRequestLength="80480" targetFramework="4.5" />

You can get it to work by removing the targetFramework="4.5" attribute to get it to work, though I don't know if there are any side effects in doing so:

<httpRuntime maxRequestLength="80480" />

edited Nov 27 '13 at 01:37

answered Nov 26 '13 at 22:36

Serj Sagan

28,927
17
154
183

This saved me on a pair of websites that use .NET 4.5.1! – Richard Ev Jul 29 '14 at 11:00
I was unable work authentication on a sub application. It's work with targetFramework="4.5" in the 2 web.config files. Thanks – Troopers May 21 '15 at 10:32

Forms Authentication across Sub-Domains on local IIS

2 Answers2

Linked