I own a lot of subdomains, but only the main domain have SSL. On each subdomain there is a different website, and all are using the same CMS system, the same files and hosting (basicly it is redirects to the main domain and using PHP I show the site they want to see). I have one SSL to my main domain only. It won't work on subdomains obviously. So I thought to submit the form to the main domain from the subdomain using AJAX, but I guess it isn't safe, so I decided that I should use:
<iframe src="https://main.com/login.php?webid=958325&pageid=83985&hash=hjWR23grvw$%F$W"></iframe>
but the problem is the cookies. How can I create a cookie that will work on all subdomains, the main domain, and if it is possible, to some specific urls (that works the same way, but domain and not subdomain).
http://php.net/setcookie
The fifth and sixth parameter might interest you, which are respectively:
(5th) domain
(6th) secure
For example:
// This cookie will only be set to domain.com/folder if a secure connection exists and will expire once the browser closes.
setcookie('cookie', $variable, 0, 'folder/', 'domain.com', true);
To have cookie working on all subdomains you need to set cookie to .example.com but it wont work on example.com, so you may need to set two cookies.
Related
I would like to share a cookie across 2 domains as my mobile site runns on a subdomain.
production server:
www.server.com
m.server.com
development server:
rabbit.server
rabbit.m.server
My PHP-code to set the cookie looks like this:
if ($settings['development'] == true) // intranet does not work with subdomains :-(
setcookie($cookiename,$sessid, $expires,'/','',0);
else // production
setcookie($cookiename,$sessid, $expires,'/', $subdomain.'.'.$domain['name'],0);
How could I share this cookie across the 2 domains in order to have the client loged in on both sites?
Is this what you mean?
"To make the cookie available to the whole domain (including all subdomains of it), simply set the value to the domain name ('example.com', in this case)."
http://php.net/manual/en/function.setcookie.php
You dont have to explicitly define the sub-domain:
setcookie('cookiename','cookievalue',time()+(3600*24),'/');
Place cookie in root and it would be accessible every where.
So basically '/' defines that it can be accessed in all the folders.
Well, there's two ways of doing this.
You can either set the cookie on the whole domain, which will allow you to access it from any subdomain, or if you wish to only allow certain subdomains then you'll have to create two cookies, one for each.
You can't have one single cookie for two different subdomains only, you can enable it on the whole domain, or you can have multiple cookies, one for each subdomain.
Code-wise you have to change
setcookie($cookiename,$sessid, $expires,'/', $subdomain.'.'.$domain['name'],0);
to
setcookie($cookiename,$sessid, $expires,'/','.'.$domain['name'],0);
I have two domains that I want to communicate. I want the first domain to set a cookie in the second domain telling the second domain that the current user is known to the first domain. I understand that I cannot read cookies for another domain, but given that I have access to both, is there a way to accomplish this?
Both domains are implemented in PHP. One is a Drupal site and the other a WordPress site.
Server can't read cookie for another domain but, you can add cookie for another domain. When adding cookies, you should add double cookie. First your normal cookie and second for another domain. Both values are the same.
I have a weird problem. I have a script that will add a number into an array for each visited page, then put it into cookies.
Then on another page, it will display the list of the numbers inside the cookies.
It is working perfectly on my domain (https) with the WWW : https://www.mydomain.com
Problem is that it won't work without the WWW (https://mydomain.com). There seems to be two different cookies: one for https://mydomain.com and another for https://www.mydomain.com
I also want to share the cookies for the subdomains WITHOUT https
So basically it should be the SAME cookie for:
https://www.domain.com
https://domain.com
http://subdomain.domain.com
How can i do that?
Currently, i use:
setcookie("viewed_articles", serialize($lastviewedarticles));
That is correct behavior. When you set the cookie, you need to set it for .domain.com and it will apply for all domains contained within domain.com.
setcookie("viewed_articles", serialize($lastviewedarticles), time()+60*60*24*30, '/', '.domain.com');
The code here will set the cookie for 30 days, and for the entire domain.com
See the php-docs for setcookie. You can add domain and path after the expired values.
Set path to / and domain to .mydomain.com to make the cookie global for your site.
Set the domain in the cookie, and also the http-only value active to avoid possible xss
setcookie("viewed_articles", serialize($lastviewedarticles), time()+3600, '/', '.yourdomain.com',0,1);
I have a website with two domain names which shows the same content from both domain names and it is also correct for sub-domain, but the problem is when I set a cookie for this website which is used in its sub-domain websites.
The cookie is being set only to one domain name, not for both.
What is the problem?
As you must know, a cookie can only be set for a domain from that domain (including its subdomains). And if your domains do not share a common superdomain, you need set each cookie for each domain separately.
You can do this with a script that on each domain that sets the cookie for you. But make sure to authenticate requests to these scripts so that only you can set the cookies.
Refer link
You can setup an API on a common domain to set cookies for all domains which want to access said cookie info. The common domain cookie would have namespace keys representing the domains, etc. and would do all the cookie reading/writing. Use XHR to access the common domain with params you wish to be placed into the common cookie. Just keep in mind Safari disables 3rd party cookies by default.
You cannot share cookies between two different domains, even if you own both of them.
SO has some posts regarding cross domain cookies, and other possible solutions:
Cross domain cookies
Cross-Domain Cookies
Cookies are not designed to be accessible for other domains
But there is always a workaround ;)
There are to method to achieve this
including 2 hidden iframes from different domains to set cookies with same value.
Ex. http://productforums.google.com/forum/#!topic/websiteoptimizer/aD4rZSoaKNo
using master and slave domain configuration
Example:
https://developers.google.com/analytics/devguides/collection/gajs/gaTrackingSite
http://www.codeguru.com/csharp/csharp/cs_internet/article.php/c19417/Sharing-Cookies-Across-Domains.htm
I was brought aware of this issue by some users on my website. A user many enter into their browser http://xxxx.com and then login. Then they may click on a link that brings them to http://www.xxxx.com it asks them to login again! Is this a known issue that anyone has encountered before? I tried googling it but im not sure if im using the wrong keywords or what because i cannot find anything related to this.
Thanks,
Ian McCullough
As far as your browser is concerned, www.xxxx.com and xxxx.com are different domains. The same-origin policy prevents accessing cookies across domains.
However, the browser is aware of subdomains, and a subdomain can access the cookies of a parent domain. So, if you want to make your cookie accessible to both xxxx.com and www.xxxx.com, just set your cookie on .xxxx.com and you'll be set.
When you set a cookie, you can optionally specify which domain the cookie is set for. If you don't, the cookie is particular to that hostname only, and thus if the cookie is set on www.example.com, it will only be returned by the browser on that hostname or below.
If, when setting the cookie, you set the domain to "example.com" it should work also on "www.example.com".
The problem is that the more specific cookie will override the less specific one, so if you've previously set a cookie on "www.example.com" it will continue to override the new one set for "example.com", rather than being replaced by it - you would first have to delete the one set for "www.example.com". It gets tricky since when the client returns a cookie to the server it doesn't say which hostname the cookie was set for.
People seem to be assuming you're using a cookie to perform authentication but are skipping what appears to be your root question. Trevor briefly touched on it, but still kept to the cookie concept. As far as http is concerned, www.xxxx.com and xxxx.com are different subdomains on the same top level domain. Hence, while they may be the same ip, same website, same everything, the browser request and the server's response are considered to be 2 separate domains/sites. Sessions are not shared across subdomains unless you have a separated session state (such as a SQL Session store, etc).
However, if you are using cookies for authentication, you can add a check for the cookie and rebuild a fresh session if the data in the cookie is valid (and sufficient to reconstruct session). Otherwise you'll have to separate session state from the process into a data store.
Check the domain of the cookie, when creating a cookie you can specify if it is for all sub domains, the root server, specific sub domain, etc. To handle all, the cookie would be for .example.com