Checking sessions from Domain A to Domain B (virtual sites)

Cent

Hi,

Just wondering if its possible for a person to log in using a form on Domain A, which then authenticates them and forwards them to Domain B. However, Domain B would need to know they were 1) authenticated and what their username was based from a Cookie set by Domain A.

Domain A is real. Domain B is a virtual domain of Domain A so all files whether they are www.domaina.com/login.php is exactly the same as www.domainb.com/login.php.

When they log in on Domain A would it be possible to write to a MySQL database with a PHP Session ID and then read that MySQL record when they get to Domain B? I just wouldn't want to pass their session id as part of the URL if possible.

Perhaps this is impossible. I'm trying to achieve something similar to Microsoft's Passport feature but on a way smaller scale for a particular purpose.

Thanks in advance for any suggestions.

Best,
C.

AstroTeg

Cookies are only available to read from from the domain they were created from (if that makes sense). Create a cookie from domain A, only domain A will be able to read it back. Domain B will have no clue the cookie exists. This is by design so a user's privacy is somewhat protected. Since sessions are usually stored in a cookie (otherwise they're passed along the URL if you're using PHP), they to are only available for the domain they're working on.

I've heard of cases of having domain A save the user's local session info to domain A and to domain B. Then you pass the user over from A to B and include the session ID. Not very secure from what I remember.

Microsoft Passport, if it hasn't changed in the past few years, works only for IE. And with IE, an ActiveX control is used to keep track of a session-like ID. Because of the way ActiveX works, any website can access the ActiveX widget and retrieve the Passport ID. This in turn allows multiple websites to use a Passport ID.

There's probably a lot of ways of working around this, the trick is more detail is needed regarding your setup and your environment.

ecumike

Yes, aliases can read/write to the same DB/table. I do it. I have 4 domain names that are all aliases, and no matter what domain name is in the URL, it can access the DB... b/c it's the same 'localhost'.

As well., after they're logged in, generate a random #, and add it to a column in the table like a unique id #. Then just pass that number from dom. A to B. Dom B. then checks to see if that random # exists in the auth table, if it does, pull that user name/data you need.

As well, for cleanup, set a timestamp in another column in the record, then create a page for a cron job that runs every min/hour/day/week/whatever to delete any auth records older than xxx # of mins/hours/days/etc.. Or just have the table clean itself up everytime it's accessed. So while it does a check to see if that # exists, have it delete any records older than xxx mins/hours/days.... etc.