python flask-user www domain has different session

Question

I have a website use flask-user and gevent and I found a problem with the sessions

if I logged in using www.example.com then enter the same website without www like example.com I will find my self not logged in!

I should have the session for www.example.com works on example.com because they are the same and I don't know where is the issue.

Answer 1

That issue is related on how session and cookies work.
Usually, when you login on a website, it stores a cookie with the exact domain you entered, therefore if you logged in on www.example.com the cookie will be set to the same domain - which is not accessible from example.com.

If you would like the cookie / session to be detected from all the domains, you should set the cookie as .example.com or if working with modern browsers only, you might set it as example.com - and it will be accessible from all subdomains.

You may read more about it here.