Cookie Domain and SameSite Policy Are Part of Cross-Subdomain SSO
One identity portal can protect many subdomains only if browser cookie scope and request behavior match the intended trust boundary.
SSO
Forward Auth Works, Then the Browser Gets Stuck in a Login Redirect Loop
Auth gateways need the original request context to decide and redirect correctly.
Authelia Sessions Needed Durable State, Not Just Longer Cookies
A longer browser cookie does not help if the server forgets the session behind it.
Session Inactivity, Expiration and Remember Me Solve Different Problems
A session can have an idle timeout, a hard lifetime and a trusted-browser persistence policy at the same time.
Authelia Authentication Failures Need Context, Not Panic
A two-factor login system naturally records failed credentials, expired sessions and rejected access, so any single failure is not automatically an attack.
Cookie Domain and SameSite Settings Are Part of SSO Architecture
Cross-subdomain authentication only works predictably when cookie scope and redirect boundaries match the domain design.
Two-Factor Policy Belongs at the Shared Access Boundary
Putting MFA in front of each application separately creates duplicated policy; Authelia gives the protected subdomains one identity boundary.