2 files changed, 14 insertions, 1 deletions
diff --git a/actionpack/lib/action_dispatch/middleware/session/abstract_store.rb b/actionpack/lib/action_dispatch/middleware/session/abstract_store.rb
index 3e8d64b0c6..040a83f7a6 100644
--- a/actionpack/lib/action_dispatch/middleware/session/abstract_store.rb
+++ b/actionpack/lib/action_dispatch/middleware/session/abstract_store.rb
@@ -121,7 +121,12 @@ module ActionDispatch
           unless options[:expire_after].nil?
             cookie[:expires] = Time.now + options.delete(:expire_after)
           end
-
+          
+          if options[:domain] == :all
+            top_level_domain = env["HTTP_HOST"].split('.')[-2..-1].join('.')
+            options[:domain] = ".#{top_level_domain}"
+          end
+          
           request = ActionDispatch::Request.new(env)
           set_cookie(request, cookie.merge!(options))
         end
diff --git a/actionpack/lib/action_dispatch/middleware/session/cookie_store.rb b/actionpack/lib/action_dispatch/middleware/session/cookie_store.rb
index 92a86ee229..0fc63d026f 100644
--- a/actionpack/lib/action_dispatch/middleware/session/cookie_store.rb
+++ b/actionpack/lib/action_dispatch/middleware/session/cookie_store.rb
@@ -34,6 +34,14 @@ module ActionDispatch
     #   integrity defaults to 'SHA1' but may be any digest provided by OpenSSL,
     #   such as 'MD5', 'RIPEMD160', 'SHA256', etc.
     #
+    # * <tt>:domain</tt>: Restrict the session cookie to certain domain level.
+    #   If you use a schema like www.example.com and wants to share session 
+    #   with user.example.com set <tt>:domain</tt> to <tt>:all</tt>
+    #     
+    #     :domain => nil  # Does not sets cookie domain. (default)
+    #     :domain => :all # Allow the cookie for the top most level
+    #                       domain and subdomains.
+    #
     # To generate a secret key for an existing application, run
     # "rake secret" and set the key in config/environment.rb.
     #