I am trying to login to Sitecore across multiple domains. I mean, I have two different sites abc.x.com and xyz.x.com.

is there a way to set the auth cookies at parent domain level, in my case at x.com level and let the user to access both the sites?

I noticed few posts for different Sitecore versions, but the one which we are using is 9.1 and i didn't find any article with Sitecore 9.1.

Sitecore 9.1 is using identity server & Owin authentication mechanism, the old posts and articles uses the legacy way of authentication and didn't work.

Any suggestions will help us.


  • Are you logging in to Sitecore, or using a custom authentication process to log into some protected area of your public website? Commented Jan 4, 2019 at 21:29
  • I am trying to login to Sitecore to show some secured content items from Sitecore.. Commented Jan 6, 2019 at 2:28
  • I am looking for a solution something like this community.sitecore.net/developers/f/8/t/1241 in Sitecore 9.1.. Any help is much appreciated.. Commented Jan 7, 2019 at 15:02
  • Did you try the solution provided in that post? Commented Jan 7, 2019 at 16:27
  • Yes I did.. Also i tried overwriting Sitecore.Security.Authentication.FormsAuthenticationProvider but no luck.. I guess Sitecore 9.1 is not using the Forms authentication manager and the architecture changed because they started using the Identity manager.. [not sure].. the request is not even reaching my custom code.. Commented Jan 7, 2019 at 17:01

2 Answers 2


Sitecore 9.1 uses the Owin authentication mechanism, in the earlier versions it uses the .Net legacy form authentication mechanism. To enable the virtual login the below steps are followed. Inherited DefaultCookieAuthenticationOptions and passed the domain and other required properties in the constructor.

    public class CustomCookieAuthenticationOptions : DefaultCookieAuthenticationOptions
        public CustomCookieAuthenticationOptions(DefaultCookieAuthenticationProvider provider, ICookieManager cookieManager, AuthenticationTypeResolver authenticationTypeResolver)
            : base(provider, cookieManager, authenticationTypeResolver)
            CookieDomain = ".x.com";
            //Based on your requirement you can set the remaining properties
            //CookieSecure = Microsoft.Owin.Security.Cookies.CookieSecureOption.Never;

Injected the above class based on the sample given in the Sitecore document Code -

public class MyServicesConfigurator : IServicesConfigurator
        public void Configure(IServiceCollection serviceCollection)
            serviceCollection.AddTransient<DefaultCookieAuthenticationOptions, CustomCookieAuthenticationOptions>();

Config -

            <configurator type= "Test.MyServicesConfigurator, Test.Poc"/>

After the above changes, it sets the cookie at x.com but CORS still failed. I mean when I login from abc.x.com and try to access the page from the domain xyz.x.com, I am not able to access the Sitecore context set in abc.x.com. [Though both the sites are published from same Sitecore instance]. When further analyzing the issue, looks like the “ASP.NET_SessionId” needs to be at parent domain level i.e. x.com level [to share the similar Sitecore session between abc.x.com and xyz.x.com]. So updated the Web.config [Sitecore instance] as below.

<httpCookies httpOnlyCookies="true" requireSSL="false" domain=".x.com" />

Now when I login from abc.x.com, all the Sitecore cookies are set at x.com including the “ASP.NET_SessionId”. So my Sitecore context built in abc.x.com is accessible in xyz.x.com and this is what I expected.


You should review Sitecore.Owin.Authentication.Pipelines.Initialize.CookieAuthentication pipeline processor. It uses Owin authentication middleware (Cookie in this case). So, your goal is to set CookieDomain property in CookieAuthenticationOptions before args.App.UseCookieAuthentication called. I think, you could do it in 2 ways:

  1. Implement your own CookieAuthentication pipeline and replace Sitecore's.
  2. Try to replace defaut DefaultCookieAuthenticationOptions (it's defined as Transient service in Sitecore.Owin.Authentication.Infrastructure.ServicesConfigurator)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.