Using sessiondata in another website

Question

I'm trying to get session variables from one website to another. The website that has the variables is a shop, the other one a regular website.

I want to know on the regular website if the user is logged in (only if, I don't need to know on what account) and how many items the user has in their cart.

My plan was to achieve this with echoing a json object on a blank page and use jQuery.get on the other website in order to get the variables. The page in the shop (transferdata.php) does display the correct object, which is

{"logged":1,"cart":9}.
However, the page that retrieves this data (getdata.php) gets

{"logged":0,"cart":0}.

Code for transferdata.php (the file in the shopwebsite)

# Check login status
if ($ca->isLoggedIn()) {
    $transferdata['logged'] = 1;
} else {
    $transferdata['logged'] = 0;
}

# Get amount of items in a cart
$transferdata['cart'] = count ($_SESSION['cart']['products']) + count ($_SESSION['cart']['addons']) + count ($_SESSION['cart']['domains']);

# Display transferdata
echo json_encode($transferdata);

Code for getdata.php (the file in the regular website)

<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.1.0/jquery.min.js"></script>
<script>
$.get( "https://**.*******.nl/transferdata.php", function( data ) {
  $( ".result" ).html( data );
  alert( "Load was performed." );
});
</script> 

<div class="result"></div>

The shop is located in a folder of the regular website (the shop is on a subdomain). I'm trying to have a navigation in the regular website for the shop, so that users can easily go to the shop from the regular website. I need the "logged" to know if I need to show the normal navigation or the version for logged in users, and I need the cartitemcount to show in "Cart (0)" in the navigation

Can anyone help me fix this? If the best answer isn't a json object, I'm open for suggestions.

Code added. Sorry for not including it in the original post. — Patrick van As
– Patrick van As, Commented Jul 25, 2016 at 17:27

Community · Accepted Answer · 2017-05-23 11:44:22Z

1

Assuming that the two sites are physically separated, it is not possible by definition. If you could request session data that way, it would be a severe security risk.

To determine the login status of a different site, implement an appropriate technique, like Single Sign-on.

edited May 23, 2017 at 11:44

CommunityBot

11 silver badge

answered Jul 25, 2016 at 17:28

Honk der Hase

2,5081 gold badge17 silver badges28 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Patrick van As Over a year ago

The shop is located in a folder of the regular website (the shop is on a subdomain). I'm trying to have a navigation in the regular website for the shop, so that users can easily go to the shop from the regular website. I need the "logged" to know if I need to show the normal navigation or the version for logged in users, and I need the cartitemcount to show in "Cart (0)" in the navigation.

Honk der Hase Over a year ago

As long as the 2 applications do not share the session id AND the storage, the sessions are separated. Only one application could access the session at a time anyway (because the session will be locked during access), so it would need cooperative programming. I'd suggest a common database for the cart and a SSO technique for the login

George Cummins · Accepted Answer · 2016-07-25 17:19:23Z

0

Use a database or other shared backend data store. If you send session data via the front end, it can be manipulated by the user (eg. setting "logged":1 when the user isn't really logged in, or "cart":9 to inspect someone else's cart).

answered Jul 25, 2016 at 17:19

George Cummins

29k8 gold badges74 silver badges91 bronze badges

Comments

Iceman · Accepted Answer · 2016-07-25 17:54:01Z

0

Sessions are expected to have identification via their origin URI.

Attempting to make any manipulation of the same through the client will result in vulnerabilities specifically the infamous: Session_fixation

A solution is to use a cross-origin request through a secure API call to the 2nd resource after authentication either from the client or server itself. Concepts such as single/social sign-in are based on this.

answered Jul 25, 2016 at 17:54

Iceman

6,1652 gold badges25 silver badges34 bronze badges

Collectives™ on Stack Overflow

Using sessiondata in another website

3 Answers 3

2 Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related