Laravel - problom of using subdomain as staging environment when using socialite

I've a domain says www.example.com and created a staging environment from it says stag.example.com.

In my server i then cloned my file to two different folder example and stag.example folders. Each of them have the .env file set correctly.

My problem i've faced is when i visit www.example.com, it generate a laravel_session with the name of .example.com and i'm able to login with facebook. With the dot infront, laravel session is able to share across the sub domain.

Now if i go to stag.example.com and login with facebook, it seems like it will go look for the laravel session with the name of .example.com instead of the session generated by the apps itself, Therefore when i login with facebook, i will get InvalidStateException at AbstractProvider.php line 191.

I can access to stag.example.com and login with facebook only when i removed the .example.com laravel session.

am i doing the wrong way to setup the staging environment using subdomain? Or we shouldnt use sub domain as staging environment?

Below are the .env file for production

APP_ENV=local
APP_DEBUG=true
APP_KEY=**Secrect**
APP_DOMAIN=example.com

DB_HOST=localhost
DB_DATABASE=example
DB_USERNAME=**Secrect**
DB_PASSWORD=**Secrect**

CACHE_DRIVER=file
SESSION_DRIVER=file
QUEUE_DRIVER=sync

SESSION_DOMAIN=example.com

MAIL_DRIVER=mailgun
MAIL_HOST=smtp.mailgun.org
MAIL_PORT=587
MAIL_USERNAME=null
MAIL_PASSWORD=null
MAIL_ENCRYPTION=null

S3_KEY=**Secrect**
S3_SECRET=**Secrect**
S3_BUCKET=**Secrect**

MAILGUN_DOMAIN=**Secrect**
MAILGUN_SECRET=**Secrect**

FB_CLIENT_ID=**Secrect**
FB_CLIENT_SECRET=**Secrect**
FB_REDIRECT=http://ift.tt/1IjHgVG

In staging

APP_ENV=local
APP_DEBUG=true
APP_KEY=**Secrect**
APP_DOMAIN=example.com

DB_HOST=localhost
DB_DATABASE=example
DB_USERNAME=**Secrect**
DB_PASSWORD=**Secrect**

CACHE_DRIVER=file
SESSION_DRIVER=file
QUEUE_DRIVER=sync

SESSION_DOMAIN=stag.example.com

MAIL_DRIVER=mailgun
MAIL_HOST=smtp.mailgun.org
MAIL_PORT=587
MAIL_USERNAME=null
MAIL_PASSWORD=null
MAIL_ENCRYPTION=null

S3_KEY=**Secrect**
S3_SECRET=**Secrect**
S3_BUCKET=**Secrect**

MAILGUN_DOMAIN=**Secrect**
MAILGUN_SECRET=**Secrect**

FB_CLIENT_ID=**Secrect**
FB_CLIENT_SECRET=**Secrect**
FB_REDIRECT=http://ift.tt/1NxYH3N

via Chebli Mohamed