Hello , Im using SelfHosted Ory kratos running as backend lets say abc.myorg.in is my UI where it has OIDC + Email & Password Registration & SignIn functionalities •

Kratos version: v0.11.0

• Deployment type: Self Hosted • Domains involved: ◦ OIDC Login → https://abc.myorg.in ◦ Email/Password Login → https://abc.myorg.in • Configured cookie domain:

session:

cookie:

domain: .<http://myorg.in|myorg.in>

Expected behavior: The

ory_kratos_session

cookie should be scoped for

.<http://myorg.in|myorg.in>

in both cases so that the session is shared across subdomains. Actual behavior: • OIDC login (on .myorg.in) → cookie scope is

.<http://myorg.in|myorg.in>

✅ • Email/password login (on abc.myorg.in) → cookie scope is

<http://abc.myorg.in|abc.myorg.in>

❌ So even though I have

session.cookie.domain

set as

.<http://myorg.in|myorg.in>

, Kratos seems to issue a cookie scoped only to the subdomain (abc.myorg.in) when the login happens through the password flow. Questions: 1. Is there any known limitation or difference in cookie scoping for OIDC vs password flows? 2. Does Kratos automatically limit cookie scope to the request’s origin even when

.<http://myorg.in|myorg.in>

is explicitly configured? Any thoughts from the team ?

Hey Bharath, 1. Not that I know of 2. no, but i think the domain should be

<http://myorg.in|myorg.in>

without the dot

HI @magnificent-energy-493 below is the screenshot of Password login where domain of cookie is set as auth.suventure.in

irrespective of what kind of login methods, it should respect the subdomain setting,

Hey @steep-hydrogen-71417 As Vincent mentioned, have you tried setting the domain as

<http://suventure.in|suventure.in>

instead of

.<http://suventure.in|suventure.in>

?

Hi @magnificent-energy-493 I tried updating the same in my YAML config (without the dot), & also restarted the Kratos service on AWS after making the configuration changes. Here are the steps I followed to restart the Kratos server: 1. Updated the

kratos.yaml

configuration file. 2. Restarted the service using the following command:

/home/<USER_NAME>/go/bin/kratos serve --dev --config ./config/kratos.yaml --watch-courier > ./kratos.log 2>&1

3. Added this command as a service. 4. Ran the following command to restart the service:

systemctl restart kratos.service

However, the issue still persists even after the restart.

I'm guessing the behavior might be related to how the login flows are completed.
 For example, the OIDC login (like Google — <http://accounts.google.com|accounts.google.com>) might finish through a different URL, while the email/password login completes directly on my home page.
Because of this, it seems that only the password-based login flow sets the cookie for the full domain instead of the subdomain.
 But it should still follow the subdomain setting mentioned in the YAML file?

Is my observation correct?