Login to client account programatically

https://tools.ietf.org/html/rfc6265

For example, the user agent will accept a cookie with a Domain attribute of "example.com" or of "foo.example.com" from foo.example.com, but the user agent will not accept a cookie with a Domain attribute of "bar.example.com" or of "baz.foo.example.com".

I would use the ".example.com" as the session domain and perform an extra check inside each sub domain (My controller) to ensure that the current user is inside his correct subdomain.

Thanks for the suggestion! I might use that as a backup in the event that I can't find another solution, as I'd prefer to use the native cookie domain as an extra layer of security.

Still open to other suggestions.