有没有办法指定将cookie保存到的子域？ （而不是一个或全部）

Question

I got my session variables being saved to all subdomains on my site via this:

Site::Application.config.session_store(
  :cookie_store, 
  :key => '_site_session',
  :domain => Settings.domain,
#  :secure => (Rails.env.production? || Rails.env.staging?), 
  :http_only => true)

where Settings.domain = '.site.com'

However, the way my site is setup, each account has their own subdomain. So this caused a big error since when someone logged in, they could enter any other subdomain and have access to that account (not all information, but some..weird).

So, what I want to do is allow people to share session variables with public subdomains (signin.site.com and signup.site.com) as well as their own personal subdomain (account1.site.com). However, those are the only ones that should be able to share it. Is there a way to specify that?

Answer 1

I'm assuming you handle logins on a subdomain like signin.site.com . It's not allowed to set the cookie for *.site.com then.

Handling the authentication and setting the cookie from http://site.com should solve the problem.