Asp.NET cookie across subdomains not updating and not expiring - cookies

Question

I have 2 subdomains and I need to set and read the same cookie from both websites.
When I use localhost, everything works fine.
When I switch to using valid urls, the cookie infomation is not really being updated when I update it (expire date on logout).
I have the domain of the cookie set to ".mysite.com"
what is wrong?

Answer 1

The answer was to set the domain to the cookie when expiring it on logout
HttpCookie aCookie = Request.Cookies["Token"];
aCookie.Expires = DateTime.Now.AddDays(-1);
aCookie.Domain = ConfigurationManager.AppSettings["CookieDomain"];
Response.Cookies.Add(aCookie);

Answer 2

Try this:
if (Request.Cookies["Token"] != null) {
HttpCookie aCookie = Request.Cookies["Token"];
aCookie.Expires = DateTime.Now.AddDays(-1);
Response.Cookies["Token"] = aCookie;
}
Instead of adding it, set it to the existing cookie.

Answer 3

Your forms authentication setting in the web.config needs to enable cross app redirects:
<authentication mode="Forms">
<forms loginUrl="~/login.aspx" protection="All" timeout="960" name=".ASPXAUTH" path="/" requireSSL="false" slidingExpiration="false" defaultUrl="~/default.aspx" enableCrossAppRedirects="true"/>
</authentication>

Answer 4

Here is my code: (works fine on localhost but not subdomain, never logs the user out because the cookie doesnt get expired)
Login page:
FormsAuthentication.SetAuthCookie(UserName.Text, true);
// set the active collab cookie
Member member = MemberManager.GetMemberByUsername(UserName.Text);
HttpCookie cookie = new HttpCookie("Token", member.Profile.Token);
cookie.Domain = ConfigurationManager.AppSettings["CookieDomain"];
cookie.Expires = DateTime.Now.AddYears(1);
Response.Cookies.Add(cookie);
Globax ASAX
if (HttpContext.Current.Request.Cookies["Token"] != null) {
string token = HttpContext.Current.Request.Cookies["Token"].Value;
if (!string.IsNullOrEmpty(token)) {
// If the user is logged in with a different token
// or not logged in at all
// then log them in with the token from the cookie
if ((MemberManager.CurrentMember != null && MemberManager.CurrentMember.Profile.Token != token) || User == null) {
Member member = MemberManager.GetMemberByToken(token);
if (member != null) {
FormsAuthentication.SetAuthCookie(member.User.UserName, true);
}
}
}
}
Logout Code:
if (Request.Cookies["Token"] != null) {
HttpCookie aCookie = Request.Cookies["Token"];
aCookie.Expires = DateTime.Now.AddDays(-1);
Response.Cookies.Add(aCookie);
}
Web.Config
<machineKey
validationKey="{-snip-}"
decryptionKey="{-snip-}"
validation="SHA1"
decryption="AES" />
<authentication mode="Forms">
<forms name="AuthCookie"
path="/"
loginUrl="~/login.aspx"
protection="All"
timeout="60">
</forms>
</authentication>