Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know that in general cookies themselves are not considered robust enough to store authentication information.

What I am wondering is if there is an existing design pattern or framework for sharing authentication across subdomains without having to use something more complex like OpenID.

Ideally, the process would be that the user visits, logs in, and continues on to where they are automatically recognized (ideally, the reverse should also be possible -- a login via xyz means automatic login at abc). The snag is that and are both on different servers and different web application frameworks, although they can both use a shared database.

The web application platforms include PHP, ColdFusion, and Python (Django), although I'm also interested in this from a more general perspective (i.e. language agnostic).

share|improve this question

you can store cookies on the domain and use the value there to log in. with specific info linking the user to cookie (plus other stuff to make sure it is the same user) in the shared DB

or implement you own OpenID with forwarding to which authenticates the user and logs him in (the shared DB can also be used as a side channel to exchange data securely between and

share|improve this answer
I'm aware that I can store cookies on the domain. What I'm wondering is what the best practice is for cross-domain authentication using shared cookies. I'm looking for advice on best-practices in terms of implementations. For example, it would be a BAD idea to just store USER_ID as a plain integer and assume that was sufficient. – Jordan Reiter Nov 9 '11 at 19:09

In general, you'll be storing some hashed value in your cookie, which will refer to some session store, server-side. The session will contain the authentication info, like a user key.

The pattern is to configure both apps to use the same:

  • parent domain for the session cookie
  • server-side session store

With ASP.NET and SQL Server, you can use the same SQL Server session store and set your session cookie domain in each app's web.config:

        <httpCookies domain="" />
            sqlConnectionString="Data Source=localhost;Integrated Security=SSPI;Application Name=example"
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.