Sharing Localstorage token amongst multiple javascript apps on same domain but different subdomains

Question

Am trying to implement a single sign in amongst different applications hosted on the same domain but on different subdomains

that is the main app is hosted on mydomain.com and i want to share the token with apps hosted on app1.mydomain.com and app2.mydomain.com

Now by default i usually set my token in localstorage via

       window.localStorage.setItem("access-token", value);

and retrieve it via

       window.localStorage.getItem("access-token");

But now with the apps hosted on the main domain but on subdomains they fail to access the same localstorage values

How do i overcome this and if there are better methods on this apart from localstorage to store the jwt token

Answer 1

This is browser storage security Issue, Browser does not allow it. LocalStorage cannot be shared across subdomains. These come under Same Origin Policy .

You can do it with some IFrame trick. For more Please check out the link here

Edit - 1

There is another approach to store the access-token , you can use cookies or session storage. These work across subdomains. It is advisable to use cookie or session for managing tokens, etc.