I have been working on a NextJS project that involves multiple apps on separate subdomains. My objective is to enable single sign-on so that when I log in to one app, I am automatically signed in to all the others. We are utilizing nookies as our cookie handler and creating a cookie with a JWT token payload received from an API. Despite trying to manually set the cookie domain, it did not result in the cookie being set on the main domain as expected.
Here are the steps I have taken:
setCookie(
null,
"token",
`JWT ${data.tokenAuth.token}`,
{
maxAge: 29 * 24 * 60 * 60,
path: "/",
domain: process.env.NEXT_PUBLIC_COOKIE_DOMAIN,
}
);
I attempted setting NEXT_PUBLIC_COOKIE_DOMAIN to both "example.com" and ".example.com", but neither approach successfully set the cookie on the main domain; it was always assigned to the current subdomain instead. I also considered placing the login page under "example.com/login" to see if this would help set the cookie on the main domain for universal access, but I prefer finding a solution without resorting to this method. Having reviewed RFC 6265, my understanding is that setting cookies only works from the main domain, yet the tracking mechanism we are using somehow manages to assign “.example.com” for its cookies. What could I be overlooking? Thank you in advance for any insights provided.