Use oauth tokens or a similar mechanism to clone session tokens between (sub)domains without leaking them. This is also a great way to provide subdomain permiss

Use oauth tokens or a similar mechanism to clone session tokens between (sub)domains without leaking them. This is also a great way to provide subdomain permission and expiry scope. Issue a master session cookie at login.mydomain or account.mydomain. If your user hits a subdomain and is not logged in, forward them there (in the background) and see if you can grant them a redeemable token for the round trip. If so, they can get a cookie issued by the subdomain in exchange for the token when they return.