Subdomain authentication

I am using the default ASP.NET authentication solution. Now I have subdomains on my server (eg. example.com, blog.example.com, forum.example.com...) The login occurs on example.com, and gives out an authentication cookie. But when I go to forum.example.com I am redirected to login. Is there a configuration settings to making the login work for *.example.com?

It's worth noting that the cookies are issued as "example.com" for the domain. So I changed it to ".example.com" based on some reading开发者_JS百科, and now sub-domain authentication works. Anyone able to explain?

According to RFC 2109, if you do not prefix a dot on the domain, it is invalid and the cookie should be rejected. From RFC 2109

Domain=domain Optional. The Domain attribute specifies the domain for which the cookie is valid. An explicitly specified domain must always start with a dot.

4.3.2  Rejecting Cookies

   To prevent possible security or privacy violations, a user agent
   rejects a cookie (shall not store its information) if any of the
   following is true:

   * The value for the Path attribute is not a prefix of the request-
     URI.

   * The value for the Domain attribute contains no embedded dots or
     does not start with a dot.