---
id: multi-domain-cookies
title: Advanced Base URL, CSRF & Session Cookie Settings
---

This document describes advanced strategies for multi-domain environments and
other scenarios.

## Base URL

The public base URL (`serve.public.base_url`) is used to compute redirect URLs,
form action URLs, and more. If you host Ory Kratos on more than one domain you
might want to enable the domain aliasing feature. This allows to register
additional base URLs. On incoming HTTP Requests, Ory Kratos checks the HTTP
`Host` Header and compares that to the list of domain aliases.

```yaml title="path/to/kratos/config.yml
serve:
  public:
    base_url: https://this-is-the-default/base-url
    domain_aliases:
      - match_domain: www.another-domain.com
        base_path: /kratos
        scheme: https
      - match_domain: that-domain.com
        base_path: /
        scheme: http
```

If a match is found, the value `serve.public.base_url` will be ignored and
instead the base URL is computed:

```
<config.protocol>://<request.host + request.port><config.base_path>
```

Values `<request.host>`, `<request.port>` are set by the incoming HTTP request
and `<config.base_path>`, `<config.protocol>`, by the config:

- Incoming request is to `https://www.another-domain.com:123/kratos/identities/`
  so the result is `https://www.another-domain.com:123/kratos`
- Incoming request is to `http://www.another-domain.com/kratos/sessions/` so the
  result is `http://www.another-domain.com/kratos`
- Incoming request is to `https://that-domain.com/identities/` so the result is
  `https://that-domain.com/identities`

## Cookies

Ory Kratos' browser features rely heavily on HTTP Cookies to mitigate common
attack vectors and make the integration as easy as possible to use. Therefore it
is important to know that

1. [HTTP Cookies ignore ports](https://stackoverflow.com/questions/1612177/are-http-cookies-port-specific),
   meaning the browser will send a cookie it received for
   `http://my-domain.com:1234` to `http://my-domain.com:4321` as well.
2. [Subdomains can set HTTP Cookies for parent domains](https://stackoverflow.com/questions/18492576/share-cookie-between-subdomain-and-domain),
   meaning a HTTP Cookie specifying `domain=my-domain.com` will be allowed to
   set even if the URL is `http://sub.my-domain.com` or
   `http://sub.sub.my-domain.com`.

You can adjust the session cookie's domain using:

```yaml title="path/to/kratos/config.yml"
# Settings for both anti-CSRF and session cookies
cookies:
  domain: www.cookies.com
  path: /cookies
  same_site: Lax

session:
  cookie:
    # Overrides cookies.domain for session cookies
    domain: my-domain.com

    # Overrides cookies.path for session cookies
    path: /

    # Overrides cookies.samesite for session cookies
    same_site: Strict

serve:
  public:
    domain_aliases:
      # When a request is coming from www.another-domain.com or that-domain.com, these these override:
      #
      # - session.cookie.domain and session.cookie.path for sessions
      # - cookies.domain and cookies.path for anti-CSRF cookies

      - match_domain: www.another-domain.com
        base_path: /kratos

        # The scheme has NO effect on the cookie `secure` flag!
        # scheme: https

      - match_domain: that-domain.com
        base_path: /

        # The scheme has NO effect on the cookie `secure` flag!
        # scheme: http
```

What **is not** currently possible is to set up Ory Kratos in a way where you
get session cookies running on two separate top level domains (e.g.
`my-domain.com` and `another-domain.com`). This is tracked as
[kratos#662](https://github.com/ory/kratos/issues/662).
