forms authentication and multiple domains

I have two domains, and pointing at the same website which uses build in form authentication. The problem is that even if the domains point to the same website the user only get authenticated for one domain at a time. So if he uses first and then visits it’s the same website in the back but he only is authenticated for The same thing happens if he uses www and not www when visiting the sites.

This is what I use to login:

FormsAuthentication.RedirectFromLoginPage(username, cookie.Checked);

To check login:

How can I make the user gets authenticated for all domains that points to the same website?


Thank you for visiting the Q&A section on Magenaut. Please note that all the answers may not help you solve the issue immediately. So please treat them as advisements. If you found the post helpful (or not), leave a comment & I’ll get back to you as soon as possible.

Method 1

What you’re after is a Single Sign-on solution.

As ASP.NET authentication is at it’s heart generally cookie based, there are two things to look at:

  1. Set your cookies correctly.
  2. Bounce your users to the alternative domain during signup.

Looking at both of these in more depth:

1. Setting cookies correctly

You need to ensure that ASP.NET is writing the authentication ticket cookies to the root domain, rather than the explicit domain this is done using the domain attribute of the forms element:


You should set your domain to “” – note the leading period – this is the key. This way requests to and will both read the cookie correctly, and authenticate the user.

2. Bounce users to the alternative domain

What we have implemented on a few sites that use a single sign on is a round trip login process. The user authenticates on the first domain, we encrypt the login details, and redirect them to a known page on the second domain, log them in there, and then redirect back to the original server.

This client side redirection is important – cookies are only written when there is a response back to the client, and the browser has to visit the second domain to actually see the cookies.

Other details to consider in this sort of set-up:

  1. You probably want to have a timeout on the encrypted sign-in details – so that recalling that URL from the browser history doesn’t automatically log the user in.
  2. If the domains are on different servers, you will need to ensure that either the machine keys are configured the same, so that you can encrypt and decrypt the details correctly, or use some other shared key.
  3. You will probably want to have a mechanism in place to recall the users ReturnUrl from the original server so that you can send them back to the correct place.

You could also take a look at “Forms Authentication Across Applications”

Method 2

You could try setting cookieless="true".

Method 3

You should read Explained: Forms Authentication on MSDN. They cover Cross-Domain Authentication.

All methods was sourced from or, is licensed under cc by-sa 2.5, cc by-sa 3.0 and cc by-sa 4.0

0 0 votes
Article Rating
Notify of

Inline Feedbacks
View all comments
Would love your thoughts, please comment.x