PHP authentication with multiple domains and subdomains

Question

I have one main domain: main.com, subdomains: test1.main.com, test2.main.com and other domains one.com, two.com.

Now it's done like these:

ini_set("session.cookie_domain", ".main.com");

$domain = 'main.com';

login.php

$user = $db->query("SELECT id, login FROM users WHERE email=? AND password=?", 
array($email, $password), "rowassoc");

if($user)
{
  $_SESSION['user_id'] = $user['id'];
  $_SESSION['user_name'] = $user['login'];

  $time = 100000; 

  setcookie('email', $email, time() + $time, "/", "." . $domain);
  setcookie('password', $password, time() + $time, "/", "." . $domain);

  header('Location: http://' . $user['login'] . "." . $domain);
  exit;
}

added on each page:

if(!isset($_SESSION['user_id']))
{
  if(isset($_COOKIE['email']) && isset($_COOKIE['password']))
  {
    $email = $_COOKIE['email'];
    $password = $_COOKIE['password'];

    $user = $db->query("SELECT id, login FROM users WHERE email=? AND password=?",
    array($email, $password), "rowassoc");

    if($user)
    {
      $_SESSION['user_id'] = $user['id'];
      $_SESSION['user_name'] = $user['login'];
    }
  }
}
else
{
  $user = $db->query("SELECT id, login FROM users WHERE id=?", 
  array($_SESSION['user_id']), "rowassoc");


  if(!$user)
  {
    setcookie('email', '', time() , "/", "." . $domain);
    setcookie('password', '', time() , "/", "." . $domain);
    unset($_SESSION['user_id']);

    session_destroy();
    setcookie("PHPSESSID","",time(), "/", "." . $domain);
  }
  else
  {
    $_SESSION['user_id'] = $user['id'];
    $_SESSION['user_name'] = $user['login'];
  }
}

logout.php

if(isset($_SESSION['user_id']))
{
  setcookie('email', '', time() , "/", "." . $domain);
  setcookie('password', '', time() , "/", "." . $domain);
  unset($_SESSION['user_id']);
  unset($_SESSION['user_name']);

  session_destroy();
  setcookie("PHPSESSID","",time(), "/", "." . $domain);

  header('Location: /main');
  exit;
}

But it works only on domain main.com and its subdomains test1.main.com, test2.main.com.

I need to somehow save the session and on other domains one.com, two.com.

How best to do safe authentication, if there are solutions, i really confused, please tell with example.

We need way more details on what you're trying to accomplish. What does authentication have to do with the different domains? Please edit your question to add more specifics. — webbiedave
– webbiedave, Commented Nov 3, 2010 at 21:38
Whoa! Do not ever store passwords in a cookie, nor DB table. Passwords should be stored hashed by the PHPass library. — Steve Clay
– Steve Clay, Commented Nov 4, 2010 at 16:25
Ajax/JS and iframe solution proposed here: stackoverflow.com/q/4813498/1066234 Check also this example here: github.com/0k/multidomain-sso — Avatar
– Avatar, Commented Aug 21, 2017 at 21:50

jeffkee · Accepted Answer · 2010-11-03 22:27:10Z

12

As far as I know, crossing sessions between sub-domains is fine, but it won't carry over to a whole new domain. To do that you need some sort of centralized data method, or an API.

Database method: you will have to create a remote MySQL data access so that domain2.com can access the database on domain1.com. When a log-in is performed, not only should it create a new session, but a unique log-in token (with an expiry time) should be put into the mysql database. Now, for every link that goes from domain1.com to domain2.com, you should add a $_GET variable that contains a randomly generated session id (md5 hash will do). domain2.com, upon receiving the visitor, will take the $_GET variable, run it through the MySQL database to find the login token, and if there is a match, consider that user to be logged on (and perhaps embed a $_COOKIE as well to store the login data). This will make the log-in transferrable between two completely different domains.

API method: you need to create an API method, so that domain1.com can respond to an external request from authorized domains to retrieve the login token upon a user being forwarded. This method will also require that all links going from domain1.com to domain2.com to be appended with a $_GET variable to pass the unique session hash. Then upon receiving the visitor, domain2.com will do a curl() request to domain1.com/userapi.php (or whatever you call the file) and the variables should be tested against what's in the database.

This is the best I can explain it.. to write this out in code is a significant piece of work so I cannot commit. But judging by your code, you have a very good understanding of PHP so I'm confident you will pull this off!

Good luck mate.

answered Nov 3, 2010 at 22:27

jeffkee

5,26412 gold badges47 silver badges80 bronze badges

Sign up to request clarification or add additional context in comments.

15 Comments

jeffkee Over a year ago

Sweet... comment here if you have any other questions, I'd be interested in getting this to work as well. As far as I know, Facebook authentication on 3rd party websites (totally different domains) use a similar API token methodology.

Steve Clay Over a year ago

Agreed, but with recommendation that OP find an existing solution rather than roll his own. "My First Security System"s are notoriously vulnerable to attack.

swamprunner7 Over a year ago

please, tell me about existing solutions

swamprunner7 Over a year ago

really can

t understand how to recieve my sessid or cookie or something from main domain. i tried send sessid on logining with img to all domains but i have so many domains, i can

t understand

jeffkee Over a year ago

So far I am unaware of existing solutions.. I tend to do heavy PHP coding on my own, from scratch. I hate Joomla/Drupal etc. For security, just use your common sense - prevent sql injections using the mysql_real_escape_string() function, make sure the tokens on the db auto-expire every 10 minutes or so UNLESS the user is active, in which case on each page-load, renew the token for another 10 minutes from the current active state. Make sure the tokens are not sent to any emails etc. and perhaps re-set the token hash on each jump from site to another.. and don't forget the md5() command!

|

Brad · Accepted Answer · 2010-11-03 22:18:48Z

2

To keep your sessions going across multiple domains, you need to use session_set_cookie_params(). With that, you can specify your domain. For example...

session_set_cookie_params(10000, "/", ".main.com");

That will set the session timeout at 10,000 seconds for all documents under the site root, and for all subdomains of main.com.

You should call session_set_cookie_params() before you do session_start().

answered Nov 3, 2010 at 22:18

Brad

164k57 gold badges380 silver badges559 bronze badges

2 Comments

swamprunner7 Over a year ago

i did it too ini_set("session.cookie_domain", ".main.com"); but problem in other domains (one.com, two.com) not subdomains.

Brad Over a year ago

Ah, I see. Well for that, you are going to have to pass the session ID manually, and probably store this session information somewhere. You can't have cookies created on one domain and read by another.

hamlet · Accepted Answer · 2012-06-04 06:09:07Z

2

But if user reach domains one.com directly, than one.com can't know if user had login by the right answer mentioned above, seems like must use some extra js, it's jsonP! we let account.main.com/userLoginStat.php?callback=loginThisDomain to check if user had login main.com, if so, the js callback function loginThisDomain do some thing to autologin user to one.com.

answered Jun 4, 2012 at 6:09

hamlet

3761 gold badge4 silver badges11 bronze badges

Collectives™ on Stack Overflow

PHP authentication with multiple domains and subdomains

3 Answers 3

15 Comments

2 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

15 Comments

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related