# Preserving sessions across domain names **URL:** \ **Category:** Rails\ **Created:** [December 3, 2005, 3:07am UTC](https://www.ruby-forum.com/t/preserving-sessions-across-domain-names/51804 "2005-12-03T03:07:31Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![phil](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/e95f7d/32.png) [@phil](https://www.ruby-forum.com/u/phil)\ **Post date:** [December 3, 2005, 3:07am UTC](https://www.ruby-forum.com/t/preserving-sessions-across-domain-names/51804/1 "2005-12-03T03:07:31Z")
We’re working on a on-line store app where the user picks items to buy in a non-secure area, and then submits their order details in a secure area (https://) that has a different domain name, but is the same physical server. Is there an easy way to preserve sessions across that jump to the other domain? Phil ---
**Author:** ![phil](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/e95f7d/32.png) [@phil](https://www.ruby-forum.com/u/phil)\ **Post date:** [December 3, 2005, 7:40am UTC](https://www.ruby-forum.com/t/preserving-sessions-across-domain-names/51804/2 "2005-12-03T07:40:27Z")
Philip E. wrote: > We’re working on a on-line store app where the user picks items to > buy in a non-secure area, and then submits their order details in a > secure area (https://) that has a different domain name, but is the > same physical server. > > Is there an easy way to preserve sessions across that jump to the > other domain? Depending on what you mean by other domain. It’s possible to share cookies (and thus cookie-based sessions) between for example secure.company.tld and www.company.tld. But it’s not possible to share it between first.tld and second.tld. This restrictions are due to security reasons (so that cookies can’t be read by other Web sites) and are defined in the RFC 2109. [http://www.w3.org/Protocols/rfc2109/rfc2109](http://www.w3.org/Protocols/rfc2109/rfc2109) I strongly recommend using the same domain for the whole site - it gets very complicated otherwise. What is your motivation for not using the same domain? Regards, Patrice ---
**Author:** ![phil](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/e95f7d/32.png) [@phil](https://www.ruby-forum.com/u/phil)\ **Post date:** [December 3, 2005, 6:27am UTC](https://www.ruby-forum.com/t/preserving-sessions-across-domain-names/51804/3 "2005-12-03T06:27:01Z")
On 12/2/05, Philip E. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > We’re working on a on-line store app where the user picks items to > buy in a non-secure area, and then submits their order details in a > secure area (https://) that has a different domain name, but is the > same physical server. > > Is there an easy way to preserve sessions across that jump to the > other domain? Since the session is tied to a cookie, probably not. This is just a guess since I haven’t looked closely at how rails sessions work in detail, but you could probably grab the session id from the cookie and pass it to the other site, which could then use that id to get the session object and copy whatever variables you need. You are probably far better off not doing that though and just have the whole order process on the same domain. Chris ---
**Author:** ![phil](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/e95f7d/32.png) [@phil](https://www.ruby-forum.com/u/phil)\ **Post date:** [December 3, 2005, 7:40am UTC](https://www.ruby-forum.com/t/preserving-sessions-across-domain-names/51804/4 "2005-12-03T07:40:27Z")
Patrice Neff wrote: > This restrictions are due to security reasons (so that cookies > can’t be read by other Web sites) and are defined in the RFC 2109. > [http://www.w3.org/Protocols/rfc2109/rfc2109](http://www.w3.org/Protocols/rfc2109/rfc2109) Correction: the current RFC for that is 2965 which obsoletes 2109. [http://www.ietf.org/rfc/rfc2965.txt](http://www.ietf.org/rfc/rfc2965.txt) Patrice ---
**Author:** ![phil](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/e95f7d/32.png) [@phil](https://www.ruby-forum.com/u/phil)\ **Post date:** [December 3, 2005, 8:04am UTC](https://www.ruby-forum.com/t/preserving-sessions-across-domain-names/51804/5 "2005-12-03T08:04:45Z")
On Dec 2, 2005, at 10:35 PM, Patrice Neff wrote: > Depending on what you mean by other domain. It’s possible to share > cookies (and thus cookie-based sessions) between for example > secure.company.tld and www.company.tld. But it’s not possible to > share it between first.tld and second.tld. This restrictions are > due to security reasons (so that cookies can’t be read by other Web > sites) and are defined in the RFC 2109. > [http://www.w3.org/Protocols/rfc2109/rfc2109](http://www.w3.org/Protocols/rfc2109/rfc2109) > > I strongly recommend using the same domain for the whole site - it > gets very complicated otherwise. What is your motivation for not > using the same domain? Oh, we’re doing “[www.myhappydomain.com](http://www.myhappydomain.com)” and “[secure.myhappydomain.com](http://secure.myhappydomain.com)” (making up the domain don’t bother looking it up ;'), so it’s the same domain technically. (and same IP) We use different names for legacy and technical reasons (don’t ask). Still though, I’ve used other environments in the pass which just pass the session ID across as a submit (GET or POST) and it automagicly preserves the session. I couldn’t find an easy way to do that Rails? Thanks! Phil ---
**Author:** ![phil](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/e95f7d/32.png) [@phil](https://www.ruby-forum.com/u/phil)\ **Post date:** [December 3, 2005, 8:49am UTC](https://www.ruby-forum.com/t/preserving-sessions-across-domain-names/51804/6 "2005-12-03T08:49:36Z")
Philip E. wrote: > Oh, we’re doing “[www.myhappydomain.com](http://www.myhappydomain.com)” and > “[secure.myhappydomain.com](http://secure.myhappydomain.com)” (making up the domain don’t bother > looking it up ;'), so it’s the same domain technically. (and same > IP) We use different names for legacy and technical reasons (don’t > ask). > > Still though, I’ve used other environments in the pass which just > pass the session ID across as a submit (GET or POST) and it > automagicly preserves the session. I couldn’t find an easy way to > do that Rails? You can change the cookie options by setting paramters of ActionController::CgiRequest::DEFAULT\_SESSION\_OPTIONS. According to [Peak Obsession](http://wiki.rubyonrails.com/rails/pages/HowtoChangeSessionOptions) the key for setting the domain is “session\_domain”. So try the following code in your production environment (environments/production.rb): ActionController::CgiRequest::DEFAULT\_SESSION\_OPTIONS.update (:session\_domain =\> “.myhappydomain.com”) Please tell me if this works. Regards, Patrice Neff ---
**Author:** ![phil](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/e95f7d/32.png) [@phil](https://www.ruby-forum.com/u/phil)\ **Post date:** [December 3, 2005, 9:26am UTC](https://www.ruby-forum.com/t/preserving-sessions-across-domain-names/51804/7 "2005-12-03T09:26:03Z")
Phil, What you need is to set the rails session cookie to .myhappydomain.com instead of the default [myhappydomain.com](http://myhappydomain.com). You should do this anyway as you would want to preserve the sessions regardless if the users types your domain with www or without. Put the following code to conf/enviroments/production.rb ActionController::CgiRequest::DEFAULT\_SESSION\_OPTIONS.update( :session\_domain =\> ‘.myhappydomain.com’) HTH, Zsombor – Company - [http://primalgrasp.com](http://primalgrasp.com) Glu4You - [http://suprglu.com](http://suprglu.com) Thoughts - [http://deezsombor.blogspot.com](http://deezsombor.blogspot.com) ---
**Author:** ![phil](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/e95f7d/32.png) [@phil](https://www.ruby-forum.com/u/phil)\ **Post date:** [December 3, 2005, 8:39pm UTC](https://www.ruby-forum.com/t/preserving-sessions-across-domain-names/51804/8 "2005-12-03T20:39:52Z")
On Dec 2, 2005, at 11:47 PM, Patrice Neff wrote: > > automagicly preserves the session. I couldn’t find an easy way to > > Please tell me if this works. Thanks. Seems simple enough. Unfortunately, I won’t be able to try it until we go live since this is an upgrade to the old site. I’m concerned that this may depend too much on browser/security settings and other client-side details. Since this would break the shopping process (the most important part) if it didn’t work, it would still be very bad if it didn’t work for a minority of folks. It also makes testing on a dev server a little trickier, too. In other development environments, I’ve ‘bridged the gap’ by submitting the session id to the other domain, which forces the session, if needed. No Rails magic here to do the same? Phil ---
**Author:** ![phil](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/e95f7d/32.png) [@phil](https://www.ruby-forum.com/u/phil)\ **Post date:** [December 3, 2005, 10:31pm UTC](https://www.ruby-forum.com/t/preserving-sessions-across-domain-names/51804/9 "2005-12-03T22:31:06Z")
On 12/3/05, Philip E. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > > > > > > production.rb): > > ActionController::CgiRequest::DEFAULT\_SESSION\_OPTIONS.update > > (:session\_domain =\> “.myhappydomain.com”) > > > > Please tell me if this works. > > Thanks. Seems simple enough. > > Unfortunately, I won’t be able to try it until we go live since this > is an upgrade to the old site. I’m concerned that this may depend > too much on browser/security settings and other client-side details. It doesn’t. But your problem is that even though your sites are all on the same domain, one is served via ssl and the other is not. Cookies won’t persist from a non ssl url to an ssl url. Chris