help with domain cookie!
I'm having trouble with cookie domain configuration for cross-subdomain authentication. The session cookies are being scoped to the Appwrite endpoint domain instead of the parent domain, preventing authentication on my main website.
Setup that does NOT work:
- Website:
example.com - Appwrite endpoint:
appwrite.example.com - Cookie domain set by Appwrite:
.appwrite.example.com - Result: Cookies are not sent when accessing
example.com(parent domain cannot access child domain cookies due to browser security)
Setup that DOES work:
- Website:
web.appwrite.example.com - Appwrite endpoint:
appwrite.example.com - Cookie domain set by Appwrite:
.appwrite.example.com - Result: Cookies work correctly (both sites under same subdomain tree)
Question: Is there a configuration option to set the session cookie domain to the parent domain (.example.com) instead of the endpoint subdomain (.appwrite.example.com)?
I've checked the environment variables documentation but couldn't find a _APP_COOKIE_DOMAIN or similar option. I've also tried adding my main domain as a platform in the console, but this only affects CORS, not cookie domain.
Additional context:
- I tried both appwrite cloud 1.8 and self-hosted Appwrite 1.7.4
- Platform hostnames are configured correctly for CORS
- Authentication works perfectly when both sites share the same subdomain parent
Is there a way to configure this, or is the only solution to restructure my domains or implement a server-side session proxy?
Thank you for your help!
my selfhosted config: _APP_DOMAIN=cms.example.com _APP_CUSTOM_DOMAIN_DENY_LIST=example.com,test.com,app.example.com _APP_DOMAIN_FUNCTIONS=fn.example.com _APP_DOMAIN_SITES=sites.example.com _APP_DOMAIN_TARGET=cms.example.com _APP_DOMAIN_TARGET_CNAME=cms.example.com
I've read your documentation on setting Appwrite endpoint under the same domain, https://appwrite.io/docs/advanced/platform/custom-domains which recommends using appwrite.my-app.com when the app runs on my-app.com to avoid 3rd-party cookie blocking. but that doesn't address the parent domain my-app.com
