Can one login protect every subdomain?

A shared login does not prove every application is protected. Inventory each hostname and its router; verify that every intended route invokes authorization.

For TinyAuth or another auth service, confirm its current cookie-domain and session settings in that product’s documentation. Test a fresh browser, sibling subdomains and an excluded public route. This page does not certify a particular TinyAuth configuration.