# Forcing the session-id **URL:** \ **Category:** Rails\ **Created:** [December 13, 2005, 9:43pm UTC](https://www.ruby-forum.com/t/forcing-the-session-id/50167 "2005-12-13T21:43:42Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Philip\_E](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/b9bd4f/32.png) [@Philip\_E](https://www.ruby-forum.com/u/Philip_E)\ **Post date:** [December 13, 2005, 9:43pm UTC](https://www.ruby-forum.com/t/forcing-the-session-id/50167/1 "2005-12-13T21:43:42Z")
We’re going to have problems keeping cookies across domains. We want people to shop in one domain (e.g. “[booksareus.com](http://booksareus.com)”) and then checkout on the same server securely under a different domain (e.g. “[greatbooks.com](http://greatbooks.com)”). When we make the jump to the secure domain (the checkout link) can we submit the user’s session ID along with it and have it ‘stick’ somehow so we don’t lose their cart? Thanks! Phil ---
**Author:** ![Philip\_E](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/b9bd4f/32.png) [@Philip\_E](https://www.ruby-forum.com/u/Philip_E)\ **Post date:** [December 14, 2005, 1:00am UTC](https://www.ruby-forum.com/t/forcing-the-session-id/50167/2 "2005-12-14T01:00:23Z")
Hi ! 2005/12/13, Philip E. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid): > We’re going to have problems keeping cookies across domains. We want > people to shop in one domain (e.g. “[booksareus.com](http://booksareus.com)”) and then checkout > on the same server securely under a different domain (e.g. > “[greatbooks.com](http://greatbooks.com)”). When we make the jump to the secure domain (the > checkout link) can we submit the user’s session ID along with it and > have it ‘stick’ somehow so we don’t lose their cart? In an app I’m coding currently, I pass the session ID in the URL, as query parameters. CGI knows how to extract it from the request instead of the cookies. I don’t know though if a cookie is then sent along on the subsequent response. Haven’t checked. Bye ! ---
**Author:** ![Philip\_E](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/b9bd4f/32.png) [@Philip\_E](https://www.ruby-forum.com/u/Philip_E)\ **Post date:** [December 14, 2005, 1:46am UTC](https://www.ruby-forum.com/t/forcing-the-session-id/50167/3 "2005-12-14T01:46:31Z")
Philip, This is what I do in environment\_mods.rb (required at the end of environment.rb) for one project that has 10+ rails sites sharing sessions. session\_options = Hash.new session\_options[:database\_manager] = CGI::Session::PStore session\_options[:prefix] = ‘xyz\_’ session\_options[:tmpdir] = ‘/home/xyz/pstore’ # Cookie session\_options[:session\_domain] = ‘.xyz.com’ session\_options[:session\_key] = ‘xyzapp’ # Assign ActionController::CgiRequest::DEFAULT\_SESSION\_OPTIONS.update(session\_options) Hope it helps, Adrian M. HyperX Inc. Mobile: 801.815.1870 Office: 801.566.0670 removed\_email\_address@domain.invalid > **[Custom Digital Marketing Solutions | Marketo Management](https://hyperxmarketing.com/)** > > Beautiful, automated, digital marketing solutions designed to maximize Marketo's power and integrate seamlessly with CRM and martech while delivering real results. HyperX is a marketing agency with more than 20 years in the business focused on... 9000 S. 45 W. Sandy, UT 84070 ---
**Author:** ![Philip\_E](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/b9bd4f/32.png) [@Philip\_E](https://www.ruby-forum.com/u/Philip_E)\ **Post date:** [December 15, 2005, 11:15pm UTC](https://www.ruby-forum.com/t/forcing-the-session-id/50167/4 "2005-12-15T23:15:53Z")
Francois B. wrote: > In an app I’m coding currently, I pass the session ID in the URL, as > query parameters. CGI knows how to extract it from the request > instead of the cookies. I don’t know though if a cookie is then sent > along on the subsequent response. Haven’t checked. Thanks, this is similar to what we ended up doing. We have a simple little Perl (gasp!) CGI which gets the cookies submitted to it and then it resets them in the new domain. It’s just too messy to try to do it within the Rails framework. It tries to create a new session before we get a chance, a before-filter does a redirect to a login because the session is apparently empty, etc. Despite RFC’s and cookie domain settings, it seems that some browsers (_cough_ firefox) still get very picky about when and who to send cookies to. It also is likely that security settings would effect how cookies (and therefore sessions) get passed between domains and protocols (i.e. http vs https). Anyways, here’s a version of our CGI for those who might find it helpful. We call it in the target domain and protocol where it sets the session and our other cookie, then redirects to $URL: #!/usr/bin/perl my $URL=“[https://secure.xxx.com/checkout/summary](https://secure.xxx.com/checkout/summary)”; use CGI; my $cgi = new CGI(); my $sessionid=$cgi-\>param(‘session\_id’); my $xxx\_zip=$cgi-\>param(‘xxx\_zip’); print “Set-Cookie: xxx\_zip=”.$xxx\_zip.“; path=/\n”; print “Set-Cookie: \_session\_id=”.$sessionid.“; path=/\n”; print “Cache-Control: no-cache\n”; print “Location: $URL\n”; print “Conntection: close\n”; print “Content-Type: text/html; charset=UTF-8\n\n”; print “\\n”;