Login to client account programatically

https://tools.ietf.org/html/rfc6265

For example, the user agent will accept a cookie with a Domain attribute of "example.com" or of "foo.example.com" from foo.example.com, but the user agent will not accept a cookie with a Domain attribute of "bar.example.com" or of "baz.foo.example.com".

I would use the ".example.com" as the session domain and perform an extra check inside each sub domain (My controller) to ensure that the current user is inside his correct subdomain.