javascript - Nginx + Node.js + express.js + passport.js: Subdommain stay authenticated -

i´ve got nginx server following config
, node.js server.

server.js

app         = express(),     cookiesession     = require('cookie-session'), app.use(cookiesession({     secret: config.session_secret,     resave: true,     saveuninitialized: true,     store: new redis({         port: config.redis_port     }),     cookie: { max_age: 43200000, domain:"localhost"} })); 

nginx.conf

worker_processes  1;      events {         worker_connections  1024;     }       http {         upstream app {             server 127.0.0.1:3000;         }          server {             listen       80;             server_name  localhost;              client_max_body_size 32m;              location / {                 proxy_set_header x-real-ip $remote_addr;                 proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;                 proxy_set_header host $http_host;                 proxy_set_header x-nginx-proxy true;                 proxy_set_header upgrade $http_upgrade;                 proxy_set_header connection "upgrade";                 proxy_pass http://app/;                 proxy_redirect off;             }         }          server {             listen       80;             server_name  sub.localhost;             client_max_body_size 32m;               location / {                 proxy_set_header x-real-ip $remote_addr;                 proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;                 proxy_set_header host $http_host;                 proxy_set_header x-nginx-proxy true;                 proxy_set_header upgrade $http_upgrade;                 proxy_set_header connection "upgrade";                 proxy_pass http://app/;                 proxy_redirect off;             }         }         } 

i´ve tried adding domain:".localhost" or domain:"*.localhost" tried adding

app.use(function(req, res, next){    // website wish allow connect      res.setheader('access-control-allow-origin', req.headers.host)     // request methods wish allow     res.setheader('access-control-allow-methods', 'get, post, options, put, patch, delete');      // request headers wish allow     res.setheader('access-control-allow-headers', 'x-requested-with,content-type');      // set true if need website include cookies in requests sent     // api (e.g. in case use sessions)     res.setheader('access-control-allow-credentials', true);         next(); }); 

to server.js

the problem is, when authenticate on localhost im not authenticated on sub.localhost.

from login session across subdomains:

you can use: domain: ".app.localhost" , work. 'domain' parameter needs 1 or more dots in domain name setting cookies.