How to share Django sessions across newly added subdomains

Question

I've recently added some new subdomains (e.g x.example.com) to my django site (all under the same app), and I'd like users to stay logged in across these subdomains.

According to the Django docs, I can simply set the SESSION_COOKIE_DOMAIN setting to be ".example.com" to do this, but the docs mention this warning:

Be cautious when updating this setting on a production site. If you update this setting to enable cross-domain cookies on a site that previously used standard domain cookies, existing user cookies will be set to the old domain. This may result in them being unable to log in as long as these cookies persist.

Given that I'm currently using standard domain cookies, this certainly applies to me! However, the docs offer no solution.

How can I switch the SESSION_COOKIE_DOMAIN to be cross-domain without messing up my existing users' sessions (and ideally, without forcing them to log out)?

Answer 1

To gracefully change the SESSION_COOKIE_DOMAIN, without existing users getting affected, you can change the SESSION_COOKIE_NAME to a new name. By default, it is set to sessionid. If you set this to some other name like newsessionid, all the existing users will have to re-login, since the new cookie will not be present in their requests.

Read more about this in the Django docs SESSION_COOKIE_NAME.