We have a main site at example.com. Logging into example.com/admin works fine there.

But on a testing site at test.example.com/admin I cannot log into the admin without first deleting all example.com cookies. Then I can log in, but as soon as I log into example.com/admin my next click on the test server kicks me back to the login page.

I don't know if this affects customer logins.

Is there some configuration in the main site or testing site that would solve this problem?

4 Answers 4

  1. On the Admin menu, select System > Configuration. Then in the panel on the left, under General, click Web.
  2. Expand the Session Cookie Management section

In the example.com shop, set the following:

  1. Set the Cookie Domain to example.com (usually this setting would be .example.com with a dot in front, you might try it without in this case).

In the test.example.com shop, set the following:

  1. Set the Cookie domain to .test.example.com on the test-environment. (the "." in front of the domain should be fine here)
  • 2
    Just a note, Step 3 about the . in front of the domain, is important!
    – B00MER
    Jun 17, 2015 at 9:06
  • Hi Anna. Should the cookie domain be set to ".example.com" in the example.com admin, the test.example.com admin, or both? Jun 17, 2015 at 19:30
  • I'd set it as default config (which is your example.com admin I guess). So this means .example.com for all scopes. Jun 17, 2015 at 19:43
  • @AnnaVölkl I'm not sure here. You understand I have two completely separate magento installations on two different machines, right? One uses example.com, the other test.example.com. They both have their own admins. But you are only telling me to set a domain for one of the admins. Are you saying I should leave the other blank? Jun 26, 2015 at 3:48
  • Ah, I see. Indeed I was not aware these are 2 sepereate installations. Does the main shop run with or without www-Domain? You could set the Cookie Domain on the Test to test.example.com and on the main shop to www.example.com then to avoid cookie overlapping. Jun 26, 2015 at 5:59

Anna makes some good points and her answer will work for a lot of people, but not for me, so I'm posting my own answer. Perhaps my problem was much more fundamental than the one she addresses.

My solution was to change my site's domain from example.com to www.example.com. In fact, my research on the internet suggests that the reason sites like Amazon, Google, Ebay, and every other major web destination use the www prefix may be in large part due to the way cookies work. Maybe not.

The default way that a cookie works is that it applies to all subdomains. So if example.com sends you a cookie, then you visit mail.example.com, smile.example.com, or devsite.example.com, then your browser will send that cookie to those sites and those sites will try to use the cookie. But they won't be able to find your session unless they all use a common session folder. And even then, you'd likely have problems because of different database configurations, different application structures, etc.

Making the change involved creating 301 redirects in my root htaccess file, changing the secure/insecure urls in the magento core_config_data database table, changing the site's ServerName in Apache VirtualHosts, and updating DNS / nameserver settings. But it was well worth it.

By making my main site www.example.com, its cookies now would only apply to subdomains thereof, such as mail.www.example.com (and we don't have any such subdomains). Client browsers that get the www.example.com cookie do not send it to devsite.example.com, and the issue is solved. Plus it's really nice to have a www in front of our domain name.

  • 1
    I wish I could give multiple Up Votes for this answer. I am looking for a solution for months and everyone keeps saying about Cookie Path and Cookie Domain, but that will not fix the problem if you don't use www. Thank you!! Feb 16, 2017 at 20:37
  • We already have www in the cookie domain, but it does still fail...
    – Black
    May 29, 2019 at 8:47
  • What does still fail? May 29, 2019 at 15:30

You can simply change adminhtml cookie name for subdomains.

Two changes in file app/code/core/Mage/Core/Controller/Varien/Action.php.

In function preDispatch change lines

/** @var $session Mage_Core_Model_Session */
$session = Mage::getSingleton('core/session', array('name' => $this->_sessionNamespace))->start();


$namespace = $this->_sessionNamespace.($_SERVER['SERVER_NAME']=='subdomain.example.com'?'_subdomain':'');
/** @var $session Mage_Core_Model_Session */
$session = Mage::getSingleton('core/session', array('name' => $namespace))->start();

In function setRedirectWithCookieCheck change

/** @var $session Mage_Core_Model_Session */
session = Mage::getSingleton('core/session', array('name' => $this->_sessionNamespace));


$namespace = $this->_sessionNamespace.($_SERVER['SERVER_NAME']=='subdomain.example.com'?'_subdomain':'');
/** @var $session Mage_Core_Model_Session */
$session = Mage::getSingleton('core/session', array('name' => $namespace));

And after that search for text

Mage::getSingleton('core/session', array('name' => 'adminhtml'));

in all files and replace it with

Mage::getSingleton('core/session', array('name' => 'adminhtml'.($_SERVER['SERVER_NAME']=='subdomain.example.com'?'_subdomain':'')));

if any occurances would be found.

  • 1
    Can you explain in words how your code alters client and server cookie interactions to isolate sessions? Mar 14, 2017 at 7:57
  • @ButtleButkus the problem is that example.com/admin sets cookie with name adminhtml for the domain .example.com. When you try to authorize at test.example.com/admin, it tries to do something with the cookie adminhtml for .test.example.com. The problems differ on Magento settings. The main problem is that you cannot modify cookie of the main domain from subdomain. The code above makes Magento to create cookie adminhtml for example.com and cookie adminhtml_subdomain for subdomain.example.com, so they will not mix in any way. Change subdomain to the correct one you use.
    – maxvgi
    Mar 15, 2017 at 8:36
  • That's good for admin side. But frontend side also should change cookie name in this kind of solution, right? Mar 15, 2017 at 10:19
  • @ButtleButkus you are right. Sorry, I did not write this because I did not have such kind of problem.
    – maxvgi
    Mar 16, 2017 at 11:50
  • It's ok, still useful for some people probably. Mar 16, 2017 at 12:44

If you are still not able to login to your frontend (customer session cannot be created) because of the cookies issues, then please override the respective core file

Pre 1.8.x. versions - app/code/core/Mage/Customer/Model/session.php


from 1.8.x. version app/code/core/Mage/Core/Model/Session/Abstract.php

Comment out the lines pointed out in this thread. This has fixed the issue with customer login on the frontend on pre 1.8.x version store.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.