5 ms·
The only clever thing they did was this: > the Identity team started laying cookies on www.theguardian.com in advance. This was a nice touch because it meant t
by lawl 13y ago
The only clever thing they did was this:
> the Identity team started laying cookies on www.theguardian.com in advance. This was a nice touch because it meant that visitors would still be logged into the site when we eventually changed domain.
Everything else? Yeah uhm, not very interesting. As they wrote themselves, there's a thing called 301 - permanently moved.
- sopooneo 13y agoI read that and understood how it would be beneficial, but not how it would be possible. Say I own x.com, and y.com and even have them both being served from the same box. If a user requests a page for x.com, how can I get them to accept a cookie for y.com?
- Tarang 13y agoI was thinking the same thing. As I understand it it's possible only to do for subdomains. I suppose one way of doing it is with some kind of script that links up to a prehosted theguardian.com so the cookie is set from where the js is included from.
- untog 13y agoYou could place an invisible iframe on the page. Ugly, but possible.
- jules 13y agoOn the old domain, make a request to the new domain with query parameters that have the information necessary to login as that user. You can do this using e.g. a hidden image, an iframe, or using javascript. The request on the new domain saves that login information in a cookie.
- sopooneo 13y agoOf course. I should have thought of that. Thank you.
- bpeebles 13y agoYou could do it through redirects to from x.com to y.com/login, which sets cookies on y.com's domain, and then redirects back to x.com. Either only do it on login or set another cooking on x.com once you've done it once. (I actually work on a web property that does similar, although for different reasons.)
- yahelc 13y agoThe other answers to your question are technically all feasible, but are all extremely unlikely to be how this was actually done. This is just what third party cookies are. Cookies set from the server-side (ie, the Set-Cookie header) can set whatever domain they want -- and if that cookie happens to not match the domain of the page you're on, that's what's called a third party cookie. Some browsers (primarily Safari IIRC), however, will automatically reject those cookies, either in all instances or depending on if you've interacted with that domain before.
- sopooneo 13y agoThank you, and I appreciate learning. But I think I'm reading something else on wikipedia. The article there says you can only set cookies on "the top domain and its subdomains" [1] and that third party cookies are those set by page assets (like images within a page) that are served from a different domain. [2] What do you think? [1] http://en.wikipedia.org/wiki/HTTP_cookie#Domain_and_Path http://en.wikipedia.org/wiki/HTTP_cookie#Domain_and_Path [2] http://en.wikipedia.org/wiki/HTTP_cookie#Third-party_cookie http://en.wikipedia.org/wiki/HTTP_cookie#Third-party_cookie
- judk 13y agoYou are correct. Parent is mistaken.
- yahelc 13y agoMy point was that the domain of the top URL you're on isn't relevant. Should have been clearer that the domain of the request itself needs to match.
- yahelc 13y agoAh, yes. I should have been clearer in my comment. Obviously, the request needs to be served from the domain or subdomain in question, but it doesn't need match the URL of the page you're on, and it doesn't need to be an iframe, nor be set by JavaScript. It can be a simple image request; doesn't need to be an iframe, and doesn't need to involve complex JavaScript. My point was that it doesn't need to require much complexity at all; just an HTTP request served by the domain in question that passes along the cookies that need to be served from the new domain.
- mcherm 13y agoNo, there was one other interesting point. Management wanted a "big splash" public rollout. Development teams wanted to avoid a "big bang" development effort. They solved this by going live many months ahead of time but ONLY for clients using special headers. This allowed anyone to test the system while still not making it "public" until the day of the big reveal. I had not previously heard of that particular technique (using special HTTP headers) and it's a useful one.
- jcampbell1 13y ago> I had not previously heard of that particular technique (using special HTTP headers) and it's a useful one. I am pretty sure by "special HTTP headers", they mean cookies.
- deleted 13y ago[deleted]
- aroch 13y agoMore likely a useragent change
- Toucan 13y agoI wouldn't be surprised if they were just manually adding a header. I've seen it done like that before, using a browser extension to add a header and then mod_rewrite to apply a special set of rules if that exists.
- watson 13y agoThe article specifically mentions how this special HTTP header was implemented client side using a browser extension and how it's handled server side
- mcherm 13y agoI doubt it. I think they've actually just made up an HTTP header. (Cookies wouldn't work anyway... how would you place them? What about expiration? How would they interact with existing cookies? What if you have to clear your cookies while debugging? Whereas a custom header requires a browser plugin, but otherwise is innocuous.)
- room271 13y agoI think you are slightly underplaying the challenges of making one of the biggest domain changes ever. Yes, the technical details are not too complex. But the risk is massive and the legwork still considerable. If you work for a very large website and want to change domain you will have been following The Guardian's move closely.
- beachstartup 13y agoyou sound like the comic book guy. back here in reality, moving sites that generate many millions of dollars is always a big deal, and when it goes correctly, acknowledgement is due.