Cookie authentication and multiple domains
<p>So we have a website hosted at www.website.com and another web app hosted at www.app.website.com.</p>

<p>The www.website.com is available for anonymous users and created using Wordpress.</p>

<p>On the other hand, www.app.website.com is a Html5 + AngularJs + C# Web API, that relies on cookie authentication.</p>

<p><strong>Current scenario</strong> </p>

<ul>
<li>A user visits www.website.com and clicks "login"</li>
<li>The browser redirects them to www.app.website.com</li>
<li>If they are authenticated then www.app.website.com redirects them to the authenticated users page</li>
<li>Otherwise, redirects them to the login page</li>
</ul>

<p><strong>Question</strong></p>

<ul>
<li>A user visits www.website.com</li>
<li>If they are authenticated, i.e., have a valid cookie, www.website.com should redirect them to www.app.website.com</li>
<li>Otherwise, they will stay in www.website.com until they press "login"</li>
</ul>

<p>As far as I understand we can issue cross domain cookies but for security reasons we should prevent Javascript from accessing them.</p>

<p>With this in mind, what would be the best redirect strategy?</p>

<p><strong>Edit:</strong>
The issued auth cookies are <a href="https://www.owasp.org/index.php/HttpOnly" rel="nofollow">HttpOnly</a>.</p>