Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

What I want is, if the user is already logged in at <https://mysite.com>, when he enters <https://sub.mysite.com>, there is no need to log in again.

Then you just use <http://mysite.com|mysite.com> as cookie domain, in that case cookies are sent to that specific domain as well as all subdomains.

With the Scale Plan you can use multiple cookie domains (it seems), so you can use the same project on <http://site1.com|site1.com> and <http://site2.com|site2.com>, although you would have to log in again on the other domain (I think).

When self-hosted you can only use a single cookie domain, e.g. <http://mysite.com|mysite.com>, and their subdomains. If you want to use the same project on multiple domains, then you would have to use OAuth2 / Hydra.

i am try to do that, but i cannot found any docs

That's not related to your cookie setup but due to your cors policy.

You need to allow the origin you are querying the Kratos endpoint from

So cookie domain determines to which endpoints your Kratos cookies are sent to, i.e. where you stay logged in, the cors policy determines from which origins you are allowed to query the Kratos instance from the browser.

how to setup the allowed origin ? use ory cli ?

it seams like i need to update plan to setup cors?

look like developer plan does't have this settings.

Yes to add a custom domain you need to be on a paid plan <@U059PCN673N>

can you let me have a trial first? make sure all thing works, then i consider to upgrade my plan.

You can use Ory Tunnel to try out things locally without a CNAME: <https://www.ory.sh/docs/guides/cli/proxy-and-tunnel>

We would love to offer free CNAMEs for trial, but we also have to pay for each CNAME unfortunately.