Re: maintain a single session across multiple servers

Samir Chouaieb wrote:
Jerry Stuckle wrote:
Samir Chouaieb wrote:
Hello,

I am trying to find a solution to a login mechanism for different domains on different servers with PHP5.

I have one main domain with the user data and several other domains that need a login to show data.

I want the user to login only once when he visits any of my domains.

The first idea is had is to use the same session for all domains. Is this possible?

Any help or hint is appreciated.

Thanks in advance

Best regards
Samir

No, it's not. Cookies are designed to be domain specific. For security reasons, the browser won't send a cookie belonging to one domain on to another domain.

If all of these sites are so closely related, why are they different sites?


> Hi,
>
> thanks first of all for your answer.
>
> > No, it's not. Cookies are designed to be domain specific.
> > For security reasons, the browser won't send a cookie
> > belonging to one domain on to another domain.
>
> You took only the cookies into consideration as a way to store session-ids.
>
> > If all of these sites are so closely related, why are they
> > different sites?
>
> Take as an example a set of partner online shops that have a central
> login mechanism.
>
>
> If the login pages of the online shops call a dedicated php-page on the
> main domain that achieves the login if not done aready and gives the
> session-id back to the referer page in the url or as POST variable.
>
> if the different shops have the same php-path for session variables on
> the main-domain server, then they will be able to read the content of
> the session.
>
> Does this make a sense. Or am I dreaming?
>
>
> Regards
> Samir
>

(Top posting fixed)

No, I'm not talking about cookies which contain session id's. Any cookie is domain specific. As will be the sessions, if you're smart.

Anything else like passing info back and forth in $_POST or $_GET variables can be very easily fudged. And even if they all have the same path on the server, there is a huge amount which can go wrong, as well as huge potential security holes. For instance, the refer page can be easily falsified. It's not hard at all.

I wouldn't even try it across multiple domains like this. And I ask again - if these are so closely related, why aren't they the same domain? They should be, IMHO. How many other sites do you see where one signon covers multiple domains?

And please don't top post.

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@xxxxxxxxxxxxx
==================
.

Relevant Pages

  • Re: Attempt to de-mystify AJAX
    ... >>maintaining a session via URL is not a problem. ... >> around cookies and JS, but it seems to be tough. ... >> as needed back to the server. ... but as I mentioned before - a non-dynamic request by the browser can ...
    (comp.databases.pick)
  • Re: HTTPS-Client bringt Fehler beim Wechsel von getIntputStream() auf getOutputStream
    ... d.h. hieße, wenn ich den Login mal durch habe, auch meinen Login? ... Genau aus dem Grund werden ja Dinge wie Cookies oder Werte ... | muss zunächst eine weitere Verbindung aufgebaut werden. ... Nur, wenn die Session an die SSL-Session gebunden ist, was ...
    (de.comp.lang.java)
  • Re: Client-Side Session Data
    ... token on the client, but does it keep the session *data* on the ... How Not To Use Cookies ... Userdata belongs on the server, ... Session time out and cookies, ...
    (comp.lang.php)
  • Re: Slow TS logon from dumb terminals.
    ... Is a login from the console also slow? ... Do the users run a login script? ... if the Real-time protection component runs in every user session. ... No virus protection as only the server has s CD Rom/USB Access/Floppy. ...
    (microsoft.public.win2000.termserv.clients)
  • Re: [Full-disclosure] Google Re-authentication Bypass with SID and LSID cookies
    ... In the 'Vulnerability' section, the URL to the previous advisory is ... Session management error ... On successful Orkut login, the following cookies are set:- ...
    (Full-Disclosure)