Currently I want to share a variable (cookie) between a WordPress (WP) application and CodeIgniter (CI) application.
Both application have the same hosting:
the WP application is using the domain,
and the CI application is using the sub-domain.
They both share the same database, and tables.
The main problem I am trying to solve is that I do not want the users to use the same credentials to login the WP, and later on the CI. Once they are login on WP, they do not need to login again on CI ... the same goes for the other way around.
I did some searching, and came on couple of solutions but I didn't understand them, that is why I decide to ask the StackOverflow community.
Any help, a link, description, answer is appreciated. Thank you guys.
You can set domain in cookie.
For your application requires cookies to have a domain in the field of the primary domain. in this case, the cookie will be available on the primary domain and subdomains. Set domain in cookie = main domain. Do same in wp and ci apps.
From php.net
domain
The (sub)domain that the cookie is available to. Setting this to a subdomain (such as 'www.example.com') will make the cookie available to that subdomain and all other sub-domains of it (i.e. w2.www.example.com). To make the cookie available to the whole domain (including all subdomains of it), simply set the value to the domain name ('example.com', in this case).
Older browsers still implementing the deprecated ยป RFC 2109 may require a leading . to match all subdomains.
Related
Is it possible to setup your two different project on a same domain and same server but different SESSION variables and point to different folders?
One is on maindomain.com (share session variables with subdomains except dashboard.maindomain.com) and one is 'dashboard.maindomain.com'
This implies that session variables must be shared between the primary domain and any subdomain, except dashboard.
Yes, it's possible.
In theory, it should be as easy as just properly configuring different cookie domains, as well as having separate storage (e.g. different file directories, in case you're using file-based sessions).
However, because cookies for example.com would be valid for and sent by clients to all subdomains, make sure to use a different session cookie name for your dashboard. subdomain. That way, it won't attempt to process cookies that weren't intended for it.
In addition, that's a security concern because your dashboard. app will now effectively be able to sniff cookies that are only intended for your main domain and other subdomains.
So, while technically possible, it might not be a good idea to do that.
I have a webserver with a drupal 7 installed on.
Many primary domains are pointing to this webserver (es domain1.com, domain2.com) and each domain is see the same website.
But if i log in into one (domain1.com) when i visit the domain2.com i'm not logged in.
I know that is a domain cookie problem, but there is a way to generate the cookie for a list of domain when i register/log in?
Hope that someone can help me
Here my module developed for getting a SSO system working with Drupal and Domain Acces.
https://github.com/andreacavattoni/DomainSSO
This is the very good question and have done small research on your question on different ways:
OAuth:
After reading the documentation and gone through many service providers it is not possible. Oauth service provider gives the consumer key and secret and they check the request coming from the domain and thus if the same oAuth consumer key is used on different domain Names that doesn't work.
Setting Cookie Multiple domains
Simply, it is not possible to set the cookie without visiting the domain by any means
Thus, I can say that it is not possible to set cookie or use the same consumer key and secret for multiple domains
Alternative ways
Use HTML5 Web Storage for storing the information and then accessing
the information from different domains is possible.
Use AJAX/CURL for sending the request for setting the cookie for different domains such as example.com/session_cookie.php?info=xxxxx
Maintain a single sub-domain/page for all the domain for login purpose for across all the domains.
I think you may want to look at Bakery
Could be of interest: Stack Exchange Blog: Global Network Auto-Login (using HTML5's local storage)
I have a homebrew CMS installed on two different web servers. Each maintain the same code. I have had a really annoying problem when I try passing $_SESSION variables between different domains.
My CMS is on domain1.com. The website it is controlling is on domain2.com. My system passes all the session variables for the login information from domain1.com to domain2.com via a url link (domain1.com has a link like this: http://domain2.com?sessionId=1gh...)(sessionId is generated by session_id()). domain2.com retrieves the session id and does session_id($_GET['sessionId']) to set the session and grab the variables. It then proceeds to show a bar at the top with admin features.
This system works well on one of my hosts, as well as my localhost. But I recently transferred to a different host and installed my CMS with the same code with success. Everything works except for this feature. When I click on the link and try to set the session_id, the session_id changes, but the $_SESSION variables are removed. When I return to my CMS, I have to relogin. Somehow on this host, changing the session_id deletes the $_SESSION variables.
I have never liked session variables and I would not use them if I were to start again (I would probably use plain cookies). But I really need to figure this out. The host that it works on is Bluehost, with both domains hosted by Bluehost. The host that it does not work on is [EDIT]ByteHost, and the domain registrar is Godaddy.
Here is some example code from domain2.com:
...
if ( $_GET['sessionId'] )
{
session_id($_GET['sessionId']);
}
session_start();
echo session_id(); // returns the proper sessionId passed through the url
print_r($_SESSION); // does not work. returns array()
...
I can guarantee that the $_SESSION variables existed before, because I was still logged into my CMS.
Any ideas why session variables work on 1 host, but not on another?
I tried replacing the php.ini file with the working host one. Problem was still there.
Thank you for your time!
UPDATE
I ended up removing this from my CMS. Now, I just pass the login details over the url and it logs the person in. It works a lot cleaner.
Here are some reasons why this may not be working:
different physical server
different account for each domain (even if it's the same physical server)
different apache/php daemon for the domains (some shared hosting sites will create a separate directory for each domain, and then restrict apache from sharing information between domains. This will also have the effect of preventing session information from being passed. Think about it - do you want someone else's domain on the same hosting provider to have access to YOUR client's session info?)
configuration (apache or php), or .htaccess rules
Here is what I will recommend: stop doing this. This is a great opportunity to fix a very serious security flaw in your code. By the time you diagnose it with the hosting provider, you could probably just rewrite everything you need using HTML5 storage or secure cookies.
My guess is that the hosting provider is smart enough to protect session information form being stolen from another domain. But in either case, I strongly recommend you change the code so that it does not need to steal session information from another domain.
To have a session on multiple domains you would need to have the session id passed in the url instead of the sessions cookie as cookies only work on a single domain basis.
Using subdomains would solve the problem if they're not separate customers a.domain.com and b.domain.com
I have a server on which I am using dokuwiki to host both a homepage as well as a wiki. The server is available under www.domain.com and the wiki is available under wiki.domain.com. Internally both subdomains are served from different directories.
However this means, that everybody who wants to sign up has to sign up for the both domains and manage a duplicate set of user accounts for both subdomains.
What I would like is to have a system, where anybody can sign up on both pages and only has to log in in any of the domains and get access. ACL should still be managed separately for both domains, since I might use namespace names multiple times.
I looked through the list oft dokuwiki auth plugins, but I was not able to find anything usefull for this purpose. Another idea would be to just soft- or hardlink the auth data directory in the two installations. However this would still mean users would have to log in multiple times. Also I am not sure whether my hoster actually allows such directory links, or if this might mess up the two installations.
Is there any other way to create such a setup?
A DokuWiki farm setup might help with having the same user database for both sites. Symlinking the user file is another way.
More complicated is to share the cookies between both domains. I'm not sure how to approach this best. Maybe others can offer some ideas.
Well since this is on the same server just across your various subdomains I would imagine you would want to store the user info including logins in a shared database so that no matter which app/subdomain you insert their registration data and query for their login info from the same database. Then it's a matter of using PHP sessions for keeping track of if they are logged in across subdomains. There is already a length stack on how to achieve that here:
PHP Sessions across sub domains
Try setting the Cookie Domain to .yourdomain.com
This means your browser will deliver cookies to subdomains of yourdomain.com.
So cookies will beshared among www.yourdomain.com and wiki.yourdomain.com
I have a website which creates a cookie and I want to use this cookie in my application on Facebook. is it possible? if not, any idea how to recieve information from my website and pass it to Facebook?
You can't share cookies across domains - just subdomains. That's by design, and important (tm).
Can you have the user log in to your site using Facebook Connect to share a session across the two sites?
Just as Andy said, you can't share cookies across domains and this is an important security feature. Another thing you can't do is make cross-domain AJAX requests.
What's odd about your question is you're asking about a facebook application. Facebook applications are not hosted by facebook, so therefore you are hosting the application yourself. Since you are hosting the application yourself, it is possible you're hosting the application on the same server and even domain. Therefore if that is the case, as long as your facebook application is using an iframe and points to the application hosted on the same domain you can have cookies accessed from both the application and the website. But again, I repeat this is only if your facebook application is using an iframe and pointing to a domain that is the same as your website.
Tip: If your application or website is a subdomain, make sure to put a dot before your cookie to make it accessible on all subdomains. i.e. .domain.com