Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I know that in general cookies themselves are not considered robust enough to store authentication information.

What I am wondering is if there is an existing design pattern or framework for sharing authentication across subdomains without having to use something more complex like OpenID.

Ideally, the process would be that the user visits abc.example.org, logs in, and continues on to xyz.example.org where they are automatically recognized (ideally, the reverse should also be possible -- a login via xyz means automatic login at abc). The snag is that abc.example.org and xyz.example.org are both on different servers and different web application frameworks, although they can both use a shared database.

The web application platforms include PHP, ColdFusion, and Python (Django), although I'm also interested in this from a more general perspective (i.e. language agnostic).

share|improve this question
add comment

2 Answers

you can store cookies on the example.org domain and use the value there to log in. with specific info linking the user to cookie (plus other stuff to make sure it is the same user) in the shared DB

or implement you own OpenID with forwarding to auth.example.org which authenticates the user and logs him in (the shared DB can also be used as a side channel to exchange data securely between abc.example.org and auth.example.org)

share|improve this answer
    
I'm aware that I can store cookies on the .example.org domain. What I'm wondering is what the best practice is for cross-domain authentication using shared cookies. I'm looking for advice on best-practices in terms of implementations. For example, it would be a BAD idea to just store USER_ID as a plain integer and assume that was sufficient. –  Jordan Reiter Nov 9 '11 at 19:09
add comment

In general, you'll be storing some hashed value in your cookie, which will refer to some session store, server-side. The session will contain the authentication info, like a user key.

The pattern is to configure both apps to use the same:

  • parent domain for the session cookie
  • server-side session store

With ASP.NET and SQL Server, you can use the same SQL Server session store and set your session cookie domain in each app's web.config:

<configuration>
    <system.web>
        <httpCookies domain=".example.org" />
        <sessionState 
            mode="SQLServer"
            allowCustomSqlDatabase="true"
            sqlConnectionString="Data Source=localhost;Integrated Security=SSPI;Application Name=example"
            cookieless="false"
            timeout="20"
        />
    </system.web>
</configuration>
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.