Cross domain Security Provider - Login/Register

Hey all.

I have a subdomain (the main app where users login/register) and a public facing project on the main domain.

So www.maindomain.com and app.maindomain.com.

Both are on a different project within Wappler - but both point to the same external managed DB (AWS RDS).

Is it possible to log a user in on www.maindomain.com and redirect them to the app without any security session cookie issues etc. ?

If so, what would be the advised way to do this?

Will simply logging a user in with the same DB using the security provider and security login actions in the SC create a session that will work across both?

Little friendly bump - would really like to know if this is even possible? Ran some tests last night and couldn’t get it to work, wondering if I can set a session or something that would work? Any pointers to documents/guidance would be appreciate - need to ideally figure this out this week!

@Teodor would you mind providing some guidance here please? I need to make some logic decisions based on if this is or is not possible.

I want someone to be able to login on project 1 (main domain) and for the security session/login to persist as I redirect them to the app - project 2 (sub-domain).

Help hugely appreciated here.

Isn’t it working if you set your maindomain.com in the cookie options for the security provider?

It wasn’t working no, unfortunately. I’ll triple check everything. Do I need to set the Security provider with the same Secret Key on both projects/domains?

Hi, i did it last year. Two different wappler projects, one on domain.com and one on sub.domain.com and it worked… Just copy paste the data from first security provider

1 Like

@Teodor looking at some of the session data in the console, it looks like it might be - but how would I access a users session information purely using App Connect, and no SC actions? (I want to set a condition if a user is logged in, on another domain).

Server sessions and browser sessions are two totally different things. You need the server sessions.

Ok, thanks Teodor. Very new to this part - trying to figure out how to set conditions when a user is already logged in on another domain, (cross domain).

Hi @Teodor would you mind sharing some guidance here?

Ultimately what I am trying to do - is maintain a secure, logged in session across two domains. (app.mymaindomain.com, and www.mymaindomain.com).

I want to be able to do two things:

  • log users in on www.mymaindomain.com, then if they go to app.mymaindomain.com - they can access all the secure features)
  • use conditions on app.mydomain.com based on their logged in session_id. E.g. instead of a login form (if logged in) - show a different form, instead - and even show that they are logged in in the nav header.

Note: the main app that people spend most time in is on app.mymaindomain.com - and the public facing site is www.mymaindomain.com).

I’m sure this is a simple one - but I haven’t cracked it yet. Any guidance of the best way to do this would be appreciated.

When you setup your security provider use the mymaindomain.com in the cookie settings, this way the user will be logged in on the subdomain as well.