My application at mysubdomain.mydomain.com needs to set a cookie that contains some user session information.

They log in at a https page. We authenticate them and set some session info in a cookie.

We do this in a helper library that takes in the controller context

contextBase.Response.Cookies[CookiePayload.CookieName].Value = encryptedTicket;                       
contextBase.Response.Cookies[CookiePayload.CookieName].Expires = cookieExpires;
contextBase.Response.Cookies[CookiePayload.CookieName].Domain= ConfigHelper.CookieDomain;
contextBase.Response.Cookies[CookiePayload.CookieName].HttpOnly=true;

We do a quick redirect in the controller (to a non https page):

this.ControllerContext.HttpContext.Response.Redirect(redirectTo, false);
return null;

The cookie appears in the response (according to firebug's net tab).

But neither fireforx nor ie send the cookie on subsequent gets.

We are setting the cookie domain to mydomain.com even though the site is mysubdomain.mydomain.com. Skipping the redirect command has no effect, nor does changing the cookie value.

I'm baffled. Thanks for any suggestions.