There is currently an issue with subdomain workspace apps on workspace proxies, where if you have a workspace proxy wildcard nested beneath the primary wildcard, cookies from the primary may be sent to the server before cookies from the proxy specifically.

Currently:

1. Use a subdomain app via the primary proxy *.coder.corp.com
   a. Client sends no cookies
   a. Server does token smuggling flow
   a. Server sets a cookie coder_subdomain_app_session_token on *.coder.corp.com
   a. Server redirects client to reload the page
   a. Request should succeed as usual
2. Wait until the primary proxy's session token cookie has expired in the database (or make it invalid yourself)
3. Use a subdomain app via a separate proxy *.sydney.coder.corp.com
   a. Client sends coder_subdomain_app_session_token cookie from *.coder.corp.com
   a. Server validates supplied cookie, it fails because it's expired
   a. Server does token smuggling flow
   a. Server sets a cookie coder_subdomain_app_session_token on *.sydney.coder.corp.com
   a. Server redirects client to reload page
   a. Client sends BOTH cookies.
   a. The server will only process the first cookie it receives, so if the expired cookie for the primary proxy is sent first the request will end up in a permanent loop on step b.

The fix is to append _{hash(wildcard_access_url)} to the subdomain cookies as we cannot control browser behavior further. This avoids the conflict as each proxy will only read it's specific cookie.