Nginx and Cross Subdomain Cookies

Question

TLDR: How to share cookies between subdomains for a backend application sever that I cannot "configure" using nginx as a proxy - some magical combination of proxy_*?

A tornado web server is running on "127.0.0.1:9999/ipython" that I cannot configure (it's running as part of an ipython notebook server). I'm using nginx to proxy from "www.mysite.com" to 127.0.0.1:9999 successfully (http traffic at least).

However, part of the backend application requires Websockets. Because I am using CloudFlare, I have to use a separate domain for Websockets ("Websockets are currently only available for Enterprise customers ... All other customers ... should create a subdomain for Websockets in their CloudFlare DNS and disable the CloudFlare proxy"). I'm using "ws.mysite.com".

When a user logs in at "https :// www.mysite.com", a cookie is set by the tornado web server for "www.mysite.com" (I can't seem to configure it, otherwise I would just set it to ".mysite.com"). When the websocket part of the application kicks in, it sends a request to "wss :// ws.mysite.com", but fails to authenticate because the cookie is set for a different domain("www.mysite.com").

Is it possible for nginx to "spoof" the domain so the tornado webserver registers it for ".mysite.com"? proxy_cookie_domain doesn't seem to work as I'd expect... Should I hard code "proxy_set_header Host"?

I was thinking a nginx conf similar to....

upstream ipython_server {
    server 127.0.0.1:8888;
}

server {
    listen 443;
    server_name www.mysite.com;

    ssl_certificate cert.crt;
    ssl_certificate_key cert.key;
    ssl on;

    # **** THIS DOESN'T WORK ??? ****
    proxy_cookie_domain www.mysite.com .mysite.com;

    location /ipython/static {
        proxy_pass https://ipython_server$request_uri;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    location /ipython/api/sessions {
        proxy_pass https://ipython_server$request_uri;
        proxy_set_header Host $host;
        proxy_set_header Origin "";
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    location /ipython {
        proxy_pass https://ipython_server$request_uri;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    location / {
            try_files $uri $uri/ =404;
    }
}

server {
    listen 443;
    server_name ws.azampagl.com;

    ssl_certificate cert.crt;
    ssl_certificate_key cert.key;
    ssl on;

    # **** THIS DOESN'T WORK ??? ****
    proxy_cookie_domain ws.mysite.com .mysite.com;

    # This is the websocket location
    location /ipython/api/kernels/ {
        proxy_pass https://ipython_server$request_uri;

        proxy_redirect off;
        proxy_http_version 1.1;
        chunked_transfer_encoding off;
        proxy_buffering off;
        proxy_read_timeout 86400;

        proxy_set_header Host $host;
        proxy_set_header Origin "";
        proxy_set_header Upgrade websocket;
        proxy_set_header Connection "upgrade";

        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-NginX-Proxy true;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

I've been looking in the nginx lua module? It looks like you can set cookie domains, but it looks hackish...

Thanks greatly in advance for your assistance!

(Side note: I do technically have access to the tornado configuration, but there is zero documentation on how to set the "cookie domain" for the server. i.e.

c.NotebookApp.tornado_settings = {'cookie_domain????':'.mysite.com'}

)