ADR-006: Shared session cookie across hosts
Status: accepted 6 September 2026.
Context
Section titled “Context”Login and registration live on the root domain; each shop lives on a subdomain. With a host-only cookie a successful login on the root bounced straight back to the login page on the subdomain. Browser verification found this; the automated suite could not, because tests authenticate directly and never cross hosts.
Decision
Section titled “Decision”Set SESSION_DOMAIN to the parent domain (.flowery.test locally, the production apex in deployment). Cross-origin redirects use Inertia::location() so the Inertia client can follow them. When the cookie domain changes, rotate SESSION_COOKIE so stale host-only cookies do not shadow the new one.
Consequences
Section titled “Consequences”- One login covers the root and every workspace subdomain.
- The first production deploy after the change must rotate the cookie name.
- A member of several workspaces is authenticated on all of them; authorization per workspace is still decided by the host tenant’s membership.