I have a website with multiple subdomains, which share a unique PHP session cookie to identify each user. I did this by simply adding session.cookie_domain = '.mydomain.com', however I'm wondering if it's possible to specify more than one subdomain, so that cookies will only get sent to, for example, www.mydomain.com and user.mydomain.com but won't in images.mydomain.com.
Would this be possible?
No, those would have to be 2 separate cookies.
You would have to create a sub-domain like sub.mydomain.com, have hosts like www.sub.mydomain.com etc., and set cookies for .sub.mydomain.com if you wanted to isolate cookies in that way...
for future users, actually you can just rename the cookie id and you can have specific cookie for that subdomain
Related
I would like to share a cookie across 2 domains as my mobile site runns on a subdomain.
production server:
www.server.com
m.server.com
development server:
rabbit.server
rabbit.m.server
My PHP-code to set the cookie looks like this:
if ($settings['development'] == true) // intranet does not work with subdomains :-(
setcookie($cookiename,$sessid, $expires,'/','',0);
else // production
setcookie($cookiename,$sessid, $expires,'/', $subdomain.'.'.$domain['name'],0);
How could I share this cookie across the 2 domains in order to have the client loged in on both sites?
Is this what you mean?
"To make the cookie available to the whole domain (including all subdomains of it), simply set the value to the domain name ('example.com', in this case)."
http://php.net/manual/en/function.setcookie.php
You dont have to explicitly define the sub-domain:
setcookie('cookiename','cookievalue',time()+(3600*24),'/');
Place cookie in root and it would be accessible every where.
So basically '/' defines that it can be accessed in all the folders.
Well, there's two ways of doing this.
You can either set the cookie on the whole domain, which will allow you to access it from any subdomain, or if you wish to only allow certain subdomains then you'll have to create two cookies, one for each.
You can't have one single cookie for two different subdomains only, you can enable it on the whole domain, or you can have multiple cookies, one for each subdomain.
Code-wise you have to change
setcookie($cookiename,$sessid, $expires,'/', $subdomain.'.'.$domain['name'],0);
to
setcookie($cookiename,$sessid, $expires,'/','.'.$domain['name'],0);
I have a website with two domain names which shows the same content from both domain names and it is also correct for sub-domain, but the problem is when I set a cookie for this website which is used in its sub-domain websites.
The cookie is being set only to one domain name, not for both.
What is the problem?
As you must know, a cookie can only be set for a domain from that domain (including its subdomains). And if your domains do not share a common superdomain, you need set each cookie for each domain separately.
You can do this with a script that on each domain that sets the cookie for you. But make sure to authenticate requests to these scripts so that only you can set the cookies.
Refer link
You can setup an API on a common domain to set cookies for all domains which want to access said cookie info. The common domain cookie would have namespace keys representing the domains, etc. and would do all the cookie reading/writing. Use XHR to access the common domain with params you wish to be placed into the common cookie. Just keep in mind Safari disables 3rd party cookies by default.
You cannot share cookies between two different domains, even if you own both of them.
SO has some posts regarding cross domain cookies, and other possible solutions:
Cross domain cookies
Cross-Domain Cookies
Cookies are not designed to be accessible for other domains
But there is always a workaround ;)
There are to method to achieve this
including 2 hidden iframes from different domains to set cookies with same value.
Ex. http://productforums.google.com/forum/#!topic/websiteoptimizer/aD4rZSoaKNo
using master and slave domain configuration
Example:
https://developers.google.com/analytics/devguides/collection/gajs/gaTrackingSite
http://www.codeguru.com/csharp/csharp/cs_internet/article.php/c19417/Sharing-Cookies-Across-Domains.htm
I have done a redirection from www.abc.com to www.def.com using .htaccess.
The redirection is successfull but I have a problem whereby the cookies and session can only be accessed when I access the website using def.com.
The session will be missing when it is checked from abc.com.
How to copy or read the session at def.com?
Please Help me.
well you can't do it simply. Maybe see this post ?
Your cookie containing your session id (and therefore, your entire session) is only valid on the domain where it is created. So when you change domains, the cookie is no longer available. To work around this, you could send the session ID to the new domain (which is not very safe, but you might not care), and then creating a new cookie and session for that domain.
This is called "cross site scripting" (XSS) and a lot of people work very hard to make sure that what you want isn't possible. If you do find a way to do it, be sure to let us know, because that would be a MAJOR security breach.
You can only share the same session on both domains when you have access to the session data storage from both servers. Depending on the session data storage type and location, you might need to write your own session storage handler.
Besides that, you also need to make sure that the same session ID is used on both domains. If you want to use cookies for the session ID, you can only do it when your domains share a common super-domain, so they are sub-domains of the a domain like foo.example.com and bar.example.com share the super-domain example.com. In that case you need to adjust the session cookie parameter domain and set it to value .example.com for the super-domain example.com.
Otherwise, like in your example where the domains do only share com as a top level super domain, you can’t use cookies (in the first place). But you can use the URL to transfer the session ID from one domain to the other domain. To do that you need to enable session.use_trans_sid and disable session.use_only_cookies (both at least on the redirection target domain) and append the session ID to every URL pointing from one domain to the other (here you can use the SID constant).
I was brought aware of this issue by some users on my website. A user many enter into their browser http://xxxx.com and then login. Then they may click on a link that brings them to http://www.xxxx.com it asks them to login again! Is this a known issue that anyone has encountered before? I tried googling it but im not sure if im using the wrong keywords or what because i cannot find anything related to this.
Thanks,
Ian McCullough
As far as your browser is concerned, www.xxxx.com and xxxx.com are different domains. The same-origin policy prevents accessing cookies across domains.
However, the browser is aware of subdomains, and a subdomain can access the cookies of a parent domain. So, if you want to make your cookie accessible to both xxxx.com and www.xxxx.com, just set your cookie on .xxxx.com and you'll be set.
When you set a cookie, you can optionally specify which domain the cookie is set for. If you don't, the cookie is particular to that hostname only, and thus if the cookie is set on www.example.com, it will only be returned by the browser on that hostname or below.
If, when setting the cookie, you set the domain to "example.com" it should work also on "www.example.com".
The problem is that the more specific cookie will override the less specific one, so if you've previously set a cookie on "www.example.com" it will continue to override the new one set for "example.com", rather than being replaced by it - you would first have to delete the one set for "www.example.com". It gets tricky since when the client returns a cookie to the server it doesn't say which hostname the cookie was set for.
People seem to be assuming you're using a cookie to perform authentication but are skipping what appears to be your root question. Trevor briefly touched on it, but still kept to the cookie concept. As far as http is concerned, www.xxxx.com and xxxx.com are different subdomains on the same top level domain. Hence, while they may be the same ip, same website, same everything, the browser request and the server's response are considered to be 2 separate domains/sites. Sessions are not shared across subdomains unless you have a separated session state (such as a SQL Session store, etc).
However, if you are using cookies for authentication, you can add a check for the cookie and rebuild a fresh session if the data in the cookie is valid (and sufficient to reconstruct session). Otherwise you'll have to separate session state from the process into a data store.
Check the domain of the cookie, when creating a cookie you can specify if it is for all sub domains, the root server, specific sub domain, etc. To handle all, the cookie would be for .example.com
I have two domains. One domain contains the login script. It creates a cookie when logged in. Another domain have a URL shortener.
So, on the 2nd domain that have the URL Shortener script have a file called session.php. Usually I was using $_COOKIE['sessionid'] to get the session id and match it using database.
How can I get the session id now? I have tried few ways but none of them have solve my problem.
For obvious security reasons, you can't read a cookie that belongs to another domain. You can do it across sub-domains though.
Why not append the session id to the forwarded URL?
Have you considered using a SSO implementation?
http://www.jasig.org/cas
http://en.wikipedia.org/wiki/Single_sign-on
We use it at work, it's awesome! It means we don't have to worry about these types of problems.
Cookies are sent by the browser and only to the domain, the cookies were set for.
There is not much (meaning nothing ;) ) you can do.
But if your domains are two different subdomains (e.g. login.yourdomain.com and shortener.yourdomain.com) you just have to set the domain name accordingly to make the cookie valid for all subdomains.
In this case, it would be .yourdomain.com.
You might want to read the documentation of setcookie().
Maybe it is better if you clearly describe what you want to accomplish. Probably there is another solution that does not involve cookies.
Just while setting cookie from the login page
set the cookie to entire domain like this
setcookie("c","value",time()*3600*24,"/");
in this way you can set cookie to your entire domain.
You can't read a cookie from the other domain.
though there are several ways to pass a session id. You can search SO for the cross-domain authorization
The easiest way is to pass a session id via query string
You can't. Cookies are bound to a single domain. You can use cookies across multiple subdomains though.