plataformatec/devise — Issue #1498: Domain Cookie Scoping and Sessions
Author: gbenedict
Created: 2011-12-10 14:39:34+00:00
State: open

I'm currently using Devise with a wildcard domain for one of my customers. The site has recently undergone a series of security audits for Salesforce.com to become a partner. We are in excellent shape except for one sticking point with them:

*They want the cookie created for the session to be scoped to the subdomain associated with the login (account.domain.com), and not the parent domain (domain.com) to prevent possible xss attacks within subdomains.*

Does anyone know how to make Rails or Devise adjust this scope on the fly?

My only thought is that we auth the user, then redirect them to a separate auth page on their subdomain that copies the session cookie to a subdomain cookie and blows away the parent domain cookie. We can then redirect them on. However, I'm not sure this really solves the issue they have because the cookie would persist for a second or so.

This isn't necessarily a Devise issue, but I was hoping that someone had run into someone similar.