3 ms·

What about internal services with subdomains? What if, for instance, you have myservice.mysite.com and you want to share cookies among www and myservice? I mea

by ecesena 12y ago

What about internal services with subdomains? What if, for instance, you have myservice.mysite.com and you want to share cookies among www and myservice? I mean, would you recommend to set cookies with domain mysite.com and thus have a different domain for external services, like support.mysite.net, or...? (genuinely asking, I don't mean to criticize, sorry if the english is not perfect :)

dlubarov 12y ago
Exactly - if you have a combination of trusted and untrusted subdomains, like www.mysite.com support.mysite.com wordpress.mysite.com Then it's impossible to give only certain ones access to your session cookie. You could use *.secure.mysite.com for all internal apps, but that seems ugly. You could also not use subdomains for any internal apps, like Google, but that's limiting in other ways - notably, it makes it impossible to have any security isolation between internal apps.
- spiralganglion 12y ago
  Downvoters — Please explain why this is a bad post. As someone in the process of learning how to run web services, explicit discussion of benefits and costs is very helpful.
  - eru 12y ago
    Don't read too much into early downvotes on HN.
  - brianbarker 12y ago
    You'll be down voted over nothing on this site. It's not worth defending.
possibilistic 12y ago
Use oauth tokens or a similar mechanism to clone session tokens between (sub)domains without leaking them. This is also a great way to provide subdomain permission and expiry scope. Issue a master session cookie at login.mydomain or account.mydomain. If your user hits a subdomain and is not logged in, forward them there (in the background) and see if you can grant them a redeemable token for the round trip. If so, they can get a cookie issued by the subdomain in exchange for the token when they return.
- ecesena 12y ago
  Thanks. I'm currently using subdomains only for trusted services, but I will definitely look towards this direction. I guess there is still some tricks when the user lands in a subdomain and needs to be redirected to another, e.g. www -> mobile, but I'll figure out the details :)

by ecesena 12y ago

dlubarov 12y ago

Exactly - if you have a combination of trusted and untrusted subdomains, like www.mysite.com support.mysite.com wordpress.mysite.com Then it's impossible to give only certain ones access to your session cookie. You could use *.secure.mysite.com for all internal apps, but that seems ugly. You could also not use subdomains for any internal apps, like Google, but that's limiting in other ways - notably, it makes it impossible to have any security isolation between internal apps.

spiralganglion 12y ago
Downvoters — Please explain why this is a bad post. As someone in the process of learning how to run web services, explicit discussion of benefits and costs is very helpful.
- eru 12y ago
  Don't read too much into early downvotes on HN.
- brianbarker 12y ago
  You'll be down voted over nothing on this site. It's not worth defending.

possibilistic 12y ago

Use oauth tokens or a similar mechanism to clone session tokens between (sub)domains without leaking them. This is also a great way to provide subdomain permission and expiry scope. Issue a master session cookie at login.mydomain or account.mydomain. If your user hits a subdomain and is not logged in, forward them there (in the background) and see if you can grant them a redeemable token for the round trip. If so, they can get a cookie issued by the subdomain in exchange for the token when they return.

ecesena 12y ago
Thanks. I'm currently using subdomains only for trusted services, but I will definitely look towards this direction. I guess there is still some tricks when the user lands in a subdomain and needs to be redirected to another, e.g. www -> mobile, but I'll figure out the details :)