asp.net membership forms cookie not showing logged in across subdomains

Question

we're using ASP.NET Membership for authentication at the root domain (www.domain.com) and the redirecting the user to a subdomain (sub.domain.com). When the user logins in from www they are being redirected to the login page on the subdomain when they should be showing as logged in instead.

Both the machine key and the forms element in the web.config are identical.

In the event log we get

Forms authentication failed for the request. Reason: The ticket supplied was invalid.

turns out it was a MS Security update that did it.

UPDATE security update available

Answer 1

What's worked for me is to set the domain attribute of the forms element to be .domain.com . This should allow the user to log in on at www.domain.com and then be logged in when accessing sub.domain.com. I've tested this having hacked my hosts file and it works okay.

<authentication mode="Forms">
   <forms loginUrl="~/Account/Login.aspx" timeout="2880" domain=".domain.com" />
</authentication>