tld_length | Ruby Gem to handle subdomains | Application Framework library

I am setting up React SPA (www.mysite.com) and Rails API (api.mysite.com) app. When I use same URL name everything works as expected, however when URL names are different, the web browser is not setting site cookie. With cookies missing, CSRF validation also fails of course. So for example if SPA App runs on localhost and Rails API App on localhost:3000 all good, the problem is only when I use the intended DNS names.

Sounds like a CORS problem but I can’t find where for many days now…

Here is my config:

Rails side I am using rack-cors ruby gem

config/initializers/cors.rb

I've got a problem with proxying of subdomain's name from nginx to rails server. In my rails app I have links like tenant1.localhost:3000, tenant2.localhost:3000, etc. and it works fine. On production I use Nginx + Puma and nginx doesn't proxy to puma any request if I open link with subdomain.

nginx.conf

I have a subdomain:

I’ve setup a Rails 5 application with Apartment (1.2.0) and Devise (4.2.0). Due to some DDNS issues there is the constraint that the app is only reachable under app.myapp.com (note the subdomain app). myapp.com redirects to app.myapp.com.

My use case is that every user (tenant) signed up to the app should access their specific data through their subdomain (e.g. tenant.myapp.com). The users should not be scoped to their subdomain. Basically it should be possible to sign in from any subdomain. Redirection to the correct subdomain for the tenant is handled by ApplicationController. As per Devise standard the login page is found at app.myapp.com/users/sign_in. That’s where the problems start:

The user cannot login because of ”email or password incorrect“ error.

In development I played around a bit. Signing in from lvh.me works perfectly well. The user is logged in and is redirected to their subdomain. Trying the same with app.lvh.me leads to the afore mentioned problem.

I’ve set the session store to: