# Setting the session token '\_t' on the entire domain, not just my subdomain

**URL:** https://meta.discourse.org/t/setting-the-session-token--t-on-the-entire-domain-not-just-my-subdomain/43254
**Category:** Development
**Created:** [April 26, 2016, 3:55pm UTC](https://meta.discourse.org/t/setting-the-session-token--t-on-the-entire-domain-not-just-my-subdomain/43254 "2016-04-26T15:55:27Z")
**Posts on this page:** 1
**Showing post:** 7

<div class="post-metadata">

### Author: ![reverend\_paco](https://avatars.discourse-cdn.com/v4/letter/r/b5ac83/32.png) [@reverend\_paco](https://meta.discourse.org/u/reverend_paco)
#### Post date: [May 1, 2016, 11:38pm UTC](https://meta.discourse.org/t/setting-the-session-token--t-on-the-entire-domain-not-just-my-subdomain/43254/7 "2016-05-01T23:38:53Z")

</div>

Matt,

I was all set to object to you, but I think I finally get it. However, I’m going to go through this just to make sure I finally (or really) understand this, (and to leave this as a historic record of my ignorance/learning that others might learn as well).

I was going to object to this statement:  
` Discourse looks at the cookie that it gets sent`

and say, “but I didn’t set a cookie”. But, now I finally think I’m getting what you were trying to tell me:

1. a user goes to the [forum.wordadodplicus.com](http://forum.wordadodplicus.com) site (dicourse) and registers. Discourse sets both the \_t (persistent) and the \_forum\_session (session) tokens.
2. the user goes to my main site (non-discourse) but no discourse cookies come through – they can’t.
3. my rules detect the lack of **my** cookies (not discourse’s)
4. because of this, my process does a 302 (or 301) to `DISCOURSE_ROOT_URL/session/sso_provider` as per this discussion: [Use Discourse as an identity provider (SSO, DiscourseConnect)](https://meta.discourse.org/t/using-discourse-as-a-sso-provider/32974)
5. this redirection sends the discourse \_t and \_s cookies (along with all the other payload info) and Discourse sends user information back to my process
6. I set **my** own cookie, indicating that we don’t need to redirect to [Discourse SSO](https://meta.discourse.org/t/13045?silent=true) API, if the user comes back again (I could make it a session cookie, or a persistent cookie, depending on what I might implement in my own session-store/database with the returned information)

You said all this before in your earlier post:

**`The main site will redirect the browser to the forum for the auth check, the forum will validate the cookies as being correct, and then automatically redirect back to the right place on the main site,`**

but I was too heads-down to read your reply properly, especially the phrase:

**` the forum will validate the cookies as being correct`**.

thanks again,  
daniel

---

_[View the full topic](https://meta.discourse.org/t/setting-the-session-token--t-on-the-entire-domain-not-just-my-subdomain/43254)._