发表新帖
发表新帖

Cookies - set across multiple domains

后端 未结
关注
5 1609
梦如初夏
梦如初夏 2021-02-01 22:01

My company has a setup as follows:

  • subdomain1.domain1.com
  • subdomain2.domain1.com
  • subdomain3.domain1.com
  • subdomain4.domain1.com
相关标签:
5条回答
  • 旧时难觅i
    2021-02-01 22:23

    As stated by others, you can't access cookies across domains. However, if you have control of the server code, you can return information in the body, and allow your client to read and store that information per server.

    In my case, I'm connecting a single client to multiple servers, maintaining an authenticated connection to each one. I need to know when the session for each one is going to expire, so the authentication service returns the cookie, plus it modifies the body of the response to send the relevant data back, so that I can read that data and set my own cookies.

    By doing this, I can manually track what I need. Won't work in every scenario, but might for some like me.

    0 讨论(0)
  • 执念已碎
    2021-02-01 22:28

    For security reasons, sites cannot set or retrieve cookies on other domains. Scripting the form submit via javascript is likely the easiest to do, and will still store the cooikes you need in the browser cache.

    0 讨论(0)
  • 死守一世寂寞
    2021-02-01 22:31

    Create a common domain specifically for your cookies and use it as a getter/setter API. 

    http://cookie.domain.com/set/domain1
http://cookie.domain.com/get/domain1

http://cookie.domain.com/set/domain2
http://cookie.domain.com/get/domain2

    and so on.

    0 讨论(0)
  • 执笔经年
    2021-02-01 22:31

    This answer is a slightly different version of my answer on the question "Set cookie on multiple domains with PHP or JavaScript".

    Do what Google is doing. Create a PHP (or any other server language file) file that sets the cookie on all 3 domains. Then on the domain where the login is going to be set, create a HTML file that would load the PHP file that sets cookie on the other 2 domains. Example:

    <html>
 <head></head>
 <body>
 Please wait..........
 <img src="http://domain2.com/setcookie.php?user=encryptedusername"/>
 <img src="http://domain3.com/setcookie.php?user=encryptedusername"/>
 </body>
</html>

    Then add an onload callback on body tag. The document will only load when the images completely load that is when cookies are set on the other 2 domains. Onload Callback :

    <head>
 <script>
 function loadComplete(){
  window.location="http://domain1.com";//URL of domain1
 }
 </script>
</head>
<body onload="loadComplete()">

    Now cookies are set on the three domains.

    Source

    0 讨论(0)
  • 感动是毒
    2021-02-01 22:39

    Include a script tag from domain2 that sets the cookie using a username and hashed password:

    <script type="text/javascript" src="http://domain2.com/cookie_login_page.php?username=johnsmith&hash=1614aasdfgh213g"></script>

    You can then check to ensure that the hashed passwords match (one way).

    Key points:

    1. Make the hashes in the URL time sensitive by appending a timestamp that will be agreed upon by the server (for example, 16:00, 16:10, etc) before hashing the string. If you're using HTTPS this is less of an issue.

    2. If your passwords are already hashed, it wont hurt to double-hash the passwords assuming the salts are the same on both servers.

    Sample PHP code:

    src:

    <script type="text/javascript" src="/cookie_login_page.php?username=<?php echo $username; ?>&hash=<?php echo md5($password . date('H')); ?>"></script>

    dest:

    <?php 

$password = get_password($_GET['username']);
if($_GET['hash'] == md5($password . date('H')) {
    // set the cookie
}
    0 讨论(0)
 看不清?
提交回复
热议问题