Shared anti-bot challenge validity across two applications

Hello,

Our configuration contains two applications (resources):

1. <site.example.com> — the main website;
2. <login.example.com> — the login page.

They have different upstreams, which is why they are configured as separate objects. The anti-bot challenge is enabled on both.

Issue: a user opens one of the resources and successfully passes the challenge. Later, during normal use, they navigate from the website to the login page (or the other way round), and the second application presents the challenge again, even though it was already solved minutes earlier. As a result, the user is challenged twice within a single session.

Questions:

1. Is it possible to share the anti-bot challenge state (session / clearance) between the two applications, so that the challenge is solved once per hour per user overall rather than once per application?
2. How exactly is the "challenge passed" state stored — is it a cookie? If so, can its scope be set to the parent domain (e.g. .example.com) so that it is valid for both hosts?
3. Is there a way to group applications into a single verification scope or a shared policy?
4. Are there any limitations if the applications sit on different second-level domains rather than on subdomains of the same domain?
5. If this cannot be configured, what workarounds do you recommend (for example, merging both into a single application with location-based routing to different upstreams)?

Could you please clarify the available configuration options?

Currently, this isn’t supported across separate applications.

1. Two independent applications can’t share the same Anti-Bot challenge state.
2. After a user passes the challenge, the state is stored in a cookie. The cookie scope can’t be changed to a parent domain.
3. There’s currently no option to group multiple applications into a shared verification scope.
4. SafeLine’s challenge cookie doesn’t set the Domain attribute, so it’s host-specific. This means even site.example.com and login.example.com won’t automatically share the cookie, despite being under the same parent domain. Different registered domains can’t share it either.
5. A possible workaround is to use a single hostname as the entry point, configure it as one application, and route different paths to different upstreams.