At a basic level, the domain for the cookie is typically set to “www.yourdomain.com”. So if you have users redirected to “premium.yourdomain.com”, they lose their cookies because their domain no longer matches. If you set the domain for your cookies to “.yourdomain.com” however, cookies set in one subdomain will match and carry over to other subdomains.

You can set this via php.ini, in your .htaccess files, through an ini_set() call, or even through a session_set_cookie_params() call. However, if you’re using Kohana (as I am), what you actually need to do is to copy system/config/cookie.php to application/config/cookie.php and modify the domain parameter to match the following:

$config['domain'] = substr($_SERVER['SERVER_NAME'],
                           strpos($_SERVER['SERVER_NAME'], '.'),
                           100);

This way, no matter what server name you’re using (development or live), the right cookie domain is set.

One final thing to keep in mind when you’ve implemented this little solution – don’t forget to clear your cookies! I spent a further twenty minutes thinking I’d missed something code-wise because Firefox still had a better-qualified cookie left over from before and was relying on that instead of my sparklin’ new “.yourdomain.com” cookie.