Magento 2 Cookies break login on subdomains

Question

I have a magento 2 install running on domains like this:

site.com
business.site.com

If you go directly to the subdomain you can login without issues but if you visit the primary domain at all cookies will be created that block you from creating session ID cookies for the subdomain. This prevents you from logging in.

Doing a little tracking it seems it does log in successfully and redirects to the account page. But then finds it isn't logged in (cookie issue) and redirects again.

After some investigation I found some people encountering similar issues in M1 What's the correct cookie config for a Magento site split across multiple instances as subdomains?

The advice was to change the cookie settings and possibly add a "." before the domain. I have tried the solution mentioned and various different variations and the results did not help

Primary Domain:
site.com - default does nothing
.site.com - breaks login for main site

Subdomain:
business.site.com - default encounters issue
.business.site.com - breaks login for subdomain site
.site.com - similar issues to default value. Direct visting works. visiting main site means the first login will fail on subdomain but subsequent logins work. logging in on main site front end will make it impossible to login on subdomain (even if you log out) until you clear cookies.

I think the only solution I have left is to switch the default site to "www.site.com" but this is not desired by the client.

Am I missing some step or doing something wrong with the "." solution or has something changed in magento 2 to make this not work anymore.

Answer 1

The cause of the whole issue seemed to be a cookie "PHPSESSID".

Whenever you view example.com it creates this cookie and when you go to business.example.com you cannot create this needed cookie as it cannot delete root domain cookies.

As a solution I created a script at example.com/unset_cookies.php which contained the following:

$past = time()-(24*60*60);

setcookie("PHPSESSID", "", $past);
setcookie("PHPSESSID", "", $past, '/', ".example.com");

Then on the login page for business.site.com I linked to this via iframe: app\design\frontend\Vendor\Wholesale\Magento_Customer\templates\form\login.phtml

<div class="block block-customer-login">
    <div class="block-title">
        <strong id="block-customer-login-heading" role="heading" aria-level="2"><?php /* @escapeNotVerified */ echo __('Registered Customers') ?></strong>
    </div>
    <div class="block-content" aria-labelledby="block-customer-login-heading">
        <form class="form form-login"
          ...
        </form>
        <div style="display: none;">
          <iframe style="width: 1px; height: 1px; display: none;" src="https://example.com/unset_cookies.php"></iframe>
        </div>
    </div>
</div>

This seemed to work for me.