I have a marketing application that is on the main domain (www.example.com ), and an admin application that is on the subdomain(accounts.example.com ). A user would visit www.example.com , register/login and gets redirected to accounts.example.com. My problem is that my session cookie from www.example.com is being overwritten when a user is redirected to accounts.example.com.
Both applications are using the same session cookie, but the accounts application always overwrites it. My data that was set for the session is no longer available after being redirected to the subdomain (unavailable in both domains). Anyone have an idea how I can approach this problem? Thank you!
Web servers usually do not permit session data to be shared across domains, or even sub domains. For that purpose, you must store the session data in a place where it can be reached across domains... e.g. a database.
Related
My customer has a domain, www.sample.com. I have completed a simple webapp for them, and is planning to host it at webapp.sample.com. Both sites are hosted at different servers (sample.com is hosted at their own hosting), while webapp.sample.com is hosted at my own AWS server. I am having trouble with the PHP Session ID, as the browser looks at both domain and subdomain, assuming it the same server. Since it is different servers (and I don't have access to their web server), I am unable to login to my webapp, unless I clear the existing Session ID from the main domain. Is there a way to have 2 separate PHP Session IDs for the main domain and sub domain.
By clearing the Cookies/Session ID from the main domain, it will allow me to login to my webapp. However, if I don't clear the Cookies/Session ID, my webapp will detect the exiting Session ID (From main site), and fail to login, as it unable to access any data/info from it, since it is a different session ID and from different server
I'm currently facing a following problem:
A main domain is running a particular PHP framework with framework specific sessions; now there is a new subdomain, which runs a different PHP framework, and I need to share the login session information from the main domain with the subdomain. I.e. users only register on the main domain, but once logged in, they will also be logged into their account on the subdomain. And it should also be noted that the subdomain cannot have access to the main domain db.
With these restrictions, I came up with the following solution: first I set the domain cookie to .mydomain.com, so I can access the session cookie on the subdomain. Next I implement a simple API call on the main domain, which returns loggedin status as well as other session information. The API url will have IP whitelist limited to the subdomain server, and once loggedin user comes from the main domain to the subdomain, the API url is requested with the users cookie serverside (cURL presumably). Once and if the user is authenticated this way on the subdomain, he is assigned a token for the particular session, and from there on I can manage that as a regular and separate session on the subdomain.
Now my question is whether you can see any flaw security-wise in this setup? Or suggest any improvements or a more preferable way to do this...
Thanks
For me, i think i will use single sign-on concept. Once user logs-in through any of domain or sub-domain, generate access-Token for that user, sign-in.
After that use that same access Token to check and authenticate user for different domain names, instead using separate sessions. This might lead to session hijacking and difficult to manage multiple sessions. Once session is created, allocate access-token, with access rules. This will make seamless process for sign-in and easy to manage as well.
For more information look to search Single Sign on or OAuth 2.0 protocol.
Here's the thing:
I have Website A in Server 1, a CakePHP 2 based website without any kind of login system.
I also have Website B in Server 2, another CakePHP website which has its login system (uses CakePHP's Auth for more details if it matters), with a login form in first page where users can enter login/password to access it.
So now what I need to do is to add a login form in website A that logs users into website B (as if they had used the form in website B).
Is that possible? If so, what approach should I take to do that securely? (By that I mean without plainly exposing the users credentials).
I assume you're doing this so that you can go between multiple sites, but only login once? I've come up with a way to do this, provided that the sites share domains, but are hosted on different subdomains by getting them to share session. The reason this only works on websites that share domains is because two completely unrelated websites cannot share cookies, which is necessary to get them to share session.
Note that since your goal is to make the two servers completely share their sessions, you will encounter some problems, like for example, flashmessages for one site will appear on both. I ended up extending the Session component so that it would automatically append to all session variables with a prefix to specify which server the session variable belongs to.
Here's an outline of the steps:
The login server will need to be able to host shared sessions, probably via memcache's session save handler, which you will need to install on both your servers. See more here: http://www.dotdeb.org/2008/08/25/storing-your-php-sessions-using-memcached/
The login server's site will need all the regular stuff for a login system, but you also need to set the server up so that it will use the shared memcache session instead of the normal way of saving session. Example once you have memcache installed, add to its php.ini file:
session.save_handler = memcache
session.save_path = "tcp://[login server ip]:11211"
The other server's site will also need to use the shared memcache session stored on the login server, so config its php.ini the same way you did for your login server. Then, set up the Auth component on this site so that it will require logins, but for actually logging in, redirect them back to your login server.
On both servers, in bootstrap.php, add the line ini_set('session.cookie_domain', '.' . ROOT_DOMAIN); Where root domain is the root domain both of them have. So if you were using test.com and subdomain.test.com, ROOT_DOMAIN would be "test". This way, the websites will also share their session cookies.
Make absolutely sure both servers are set to the same time. If their times don't match, you'll likely randomly lose your session because one of the servers will think the session is much older than the other server, and so it will delete it because it thinks the session is too old.
I run a website which has many different subdomains. We are introducing a new download server which is using a subdomain of the main domain. The way we normally check user information is with cross subdomain cookies etc but I know this wont work because they of the different server and I wondered what would be the best way of checking if the user is logged in etc on the main server.
What I am wanting to do is the following
Sub1.domain.tld = main server
When you want to download a file, it will point you to the appropriate server where the files are stored
Sub2.domain.tld = download server
Is there any way to keep or check if the user was logged in please.
The way we normally do it with cookies accross subdomains is
setcookie('LoginVariable1', $LoginVariable1, $expiretime, '/', '.domain.tld');
setcookie('LoginVariable2', $LoginVariable2, $expiretime, '/', '.domain.tld');
Cross domain cookies will exactly work in your case. The only case they would not work would be if you have "www.somedomain.example" and "download.someotherdomain.example", because you cannot define a cookie to be cross-domain for the top-level domain "example".
So this boils down to have a cookie that tells all servers something like the session id of the user, or an authentication token he got during login, and then all servers must ask some central authentication service whether this session or token is currently logged in.
If the subdomains map to different servers, you have two ways as I see it.
1) You can share the directory that php writes sessions to on server A and point server B there.
2) You can use database sessions and have both servers connect to a single database to verify/retrieve the session.
In both cases, you end up with a single, central place to store sessions.
I have a homebrew CMS installed on two different web servers. Each maintain the same code. I have had a really annoying problem when I try passing $_SESSION variables between different domains.
My CMS is on domain1.com. The website it is controlling is on domain2.com. My system passes all the session variables for the login information from domain1.com to domain2.com via a url link (domain1.com has a link like this: http://domain2.com?sessionId=1gh...)(sessionId is generated by session_id()). domain2.com retrieves the session id and does session_id($_GET['sessionId']) to set the session and grab the variables. It then proceeds to show a bar at the top with admin features.
This system works well on one of my hosts, as well as my localhost. But I recently transferred to a different host and installed my CMS with the same code with success. Everything works except for this feature. When I click on the link and try to set the session_id, the session_id changes, but the $_SESSION variables are removed. When I return to my CMS, I have to relogin. Somehow on this host, changing the session_id deletes the $_SESSION variables.
I have never liked session variables and I would not use them if I were to start again (I would probably use plain cookies). But I really need to figure this out. The host that it works on is Bluehost, with both domains hosted by Bluehost. The host that it does not work on is [EDIT]ByteHost, and the domain registrar is Godaddy.
Here is some example code from domain2.com:
...
if ( $_GET['sessionId'] )
{
session_id($_GET['sessionId']);
}
session_start();
echo session_id(); // returns the proper sessionId passed through the url
print_r($_SESSION); // does not work. returns array()
...
I can guarantee that the $_SESSION variables existed before, because I was still logged into my CMS.
Any ideas why session variables work on 1 host, but not on another?
I tried replacing the php.ini file with the working host one. Problem was still there.
Thank you for your time!
UPDATE
I ended up removing this from my CMS. Now, I just pass the login details over the url and it logs the person in. It works a lot cleaner.
Here are some reasons why this may not be working:
different physical server
different account for each domain (even if it's the same physical server)
different apache/php daemon for the domains (some shared hosting sites will create a separate directory for each domain, and then restrict apache from sharing information between domains. This will also have the effect of preventing session information from being passed. Think about it - do you want someone else's domain on the same hosting provider to have access to YOUR client's session info?)
configuration (apache or php), or .htaccess rules
Here is what I will recommend: stop doing this. This is a great opportunity to fix a very serious security flaw in your code. By the time you diagnose it with the hosting provider, you could probably just rewrite everything you need using HTML5 storage or secure cookies.
My guess is that the hosting provider is smart enough to protect session information form being stolen from another domain. But in either case, I strongly recommend you change the code so that it does not need to steal session information from another domain.
To have a session on multiple domains you would need to have the session id passed in the url instead of the sessions cookie as cookies only work on a single domain basis.
Using subdomains would solve the problem if they're not separate customers a.domain.com and b.domain.com