# Truly Separate Subdomain Sessions

**URL:** <https://forum.djangoproject.com/t/truly-separate-subdomain-sessions/40867>\
**Category:** Using Django\
**Created:** [May 9, 2025, 6:18pm UTC](https://forum.djangoproject.com/t/truly-separate-subdomain-sessions/40867 "2025-05-09T18:18:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![yamazaki117](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/yamazaki117/32/22691_2.png) [@yamazaki117](https://forum.djangoproject.com/u/yamazaki117)\
**Post date:** [May 9, 2025, 6:18pm UTC](https://forum.djangoproject.com/t/truly-separate-subdomain-sessions/40867/1 "2025-05-09T18:18:40Z")

</div>

Hello everyone!

I’m working with multiple subdomains in my Django application and have encountered a security concern regarding session cookies.

Currently, I understand that Django’s `SESSION_COOKIE_DOMAIN` setting offers two main options:

- Set it to `None` (default): Cookies are issued for the specific hostname that received the request
- Set it to a domain (e.g., `.example dot com`): Cookies are shared across all subdomains

While the first option prevents browsers from automatically sharing cookies between subdomains (e.g., `sub1 dot example dot com` and `sub2 dot example dot com`), a user can still manually copy their session cookie from one subdomain and paste it into another to gain authenticated access to either subdomain.

Is there a built-in Django way or a simple configuration option (without requiring custom middleware) to make session cookies truly unique to each subdomain? Ideally, a session cookie created on `sub1 dot example dot com` would be invalid if used on `sub2 dot example dot com`, even if manually transferred.

Any suggestions or insights would be greatly appreciated!

Thank you!

---

<div class="post-metadata">

**Author:** ![leandrodesouzadev](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/leandrodesouzadev/32/8981_2.png) [@leandrodesouzadev](https://forum.djangoproject.com/u/leandrodesouzadev)\
**Post date:** [May 9, 2025, 9:01pm UTC](https://forum.djangoproject.com/t/truly-separate-subdomain-sessions/40867/2 "2025-05-09T21:01:20Z")

</div>

Hello there, is this a security question?  
It looks like you’re affraid of an user gain unauthorized access through another authenticated domain. This tipically is the case you want to avoid on a multi-tenant architecture.  
If that’s the case, then I would write a custom middleware to do that kind of verification. Like having a tenant attribute on the user, and validating the domain being accessed.  
If not, then what you want to achieve?

---

<div class="post-metadata">

**Author:** ![yamazaki117](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/yamazaki117/32/22691_2.png) [@yamazaki117](https://forum.djangoproject.com/u/yamazaki117)\
**Post date:** [May 10, 2025, 5:03pm UTC](https://forum.djangoproject.com/t/truly-separate-subdomain-sessions/40867/3 "2025-05-10T17:03:33Z")

</div>

HI! Thanks for your reply.  
Yea, I found out that the session dictionary contains a `host` key, which was bound to the host where the session was created, so I had to settle for writing a middleware that checked this key and block cross sub domain requests. However, my request was regarding whether Django had a config that addressed this out of the box.

---

<div class="post-metadata">

**Author:** ![leandrodesouzadev](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/leandrodesouzadev/32/8981_2.png) [@leandrodesouzadev](https://forum.djangoproject.com/u/leandrodesouzadev)\
**Post date:** [May 12, 2025, 12:15pm UTC](https://forum.djangoproject.com/t/truly-separate-subdomain-sessions/40867/4 "2025-05-12T12:15:04Z")

</div>

Re-reading the documentation I have found a way of achieving such functionality.  
In your user model, you can define the [get\_session\_auth\_hash method](https://docs.djangoproject.com/en/5.2/topics/auth/customizing/#django.contrib.auth.models.AbstractBaseUser.get_session_auth_hash) that is documented on [session invalidation on password change](https://docs.djangoproject.com/en/5.2/topics/auth/default/#session-invalidation-on-password-change).  
You can use some attribute of your User model to store the latest domain logged in, and on your login view, store the latest domain logged-in. This would make that the previous session is only valid for that domain.