Let me replicate here from the test environment as this is not live for now

Here is one saved from before:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://my.offscript.io/api/auth/signin. (Reason: CORS request did not succeed).

So if you change websiteDOmain to

offscript.io

, the API call will go to

https://offscript.io/api/auth/signin

. The login screen is shown on

offscript.io

only right?

The API call goes to the subdomain in this case, and the login screen is shown in the subdomain as well. Is that the resason? We can only login/call in one place?

Ahh. ok. I thought the login screen is only on offscript.io

so is it true that you can login with offscript.io & access offscript.io and my.offscript.io AND You can login via my.offscript.io and get access to offscript.io and my.offscript.io?

or am i mis understanding the scenario?

Yes, that would be the ideal scenario!

ok wow.. i will have to think about that. give me sometime please.

may require an additional param change from our side.

Why do you have this scenario though - why not make all users just log in via offscript.io?

Basically because the home page of the subdomains redirect the user to

/auth/

as they are private pages. But I can try to redirect them to the main website and then back, I'll give it a try.

Ok, in a few moments testing it out

So the root problem is that our redirection post login ignores the domain from where the user came from. We ignore it cause of a phishing attacks where an attacker can form a malicious link redirecting a user back to their login. But perhaps we can change it to not ignore the domain if the top level domain of the source is the same - this way, it would just work for you.. what do you think of this?

Actually, I managed to make it work. I did what you said, but in the subdomains I redirect the user to the main page login.

With a /redirect parameter in the URL back

that did the trick

Thanks a lot!

Cool! So is there any change u require from our side?

Actually the verify thing might be necessary, doing more tests, it seems to work in one browser, but not safari

session doesn't stick

the verify thing?

also, what do you mean by session doesn't stick?

In one browser I can login in offscript and redirect to my, then keep logged in. But in Chrome and Safari, it says I am not logged in.

But I am still checking if it's cache from the previous version or something like it.

@gusfune did it work on the other browsers?

nope, I am deploying a patch to see if the issue I found was related

Ok. Lmk if you can get it to work. Else I would be happy to get on a call

Ok, question, do I need to make websiteDomain and apiDomain the same or can I have one in the domain and another in the root domain?

They both can have different values