# Re-using session data over different domain names

**URL:** <https://www.ruby-forum.com/t/re-using-session-data-over-different-domain-names/151474>\
**Category:** Rails\
**Created:** [October 21, 2008, 11:44pm UTC](https://www.ruby-forum.com/t/re-using-session-data-over-different-domain-names/151474 "2008-10-21T23:44:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![fipa](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/9e8a1a/32.png) [@fipa](https://www.ruby-forum.com/u/fipa)\
**Post date:** [October 21, 2008, 11:44pm UTC](https://www.ruby-forum.com/t/re-using-session-data-over-different-domain-names/151474/1 "2008-10-21T23:44:09Z")

</div>

Hi,

I am having a hard time here.

I will be managing different websites, let’s say: [www.site1.com](http://www.site1.com) and  
[www.site2.com](http://www.site2.com)

When a user wants to login on to one of these sites, he will be  
redirected to: [https://site1.com.mainsite.com](https://site1.com.mainsite.com)

Once he gives successfully his credentials, I want him to get redirected  
to [www.site1.com](http://www.site1.com)

I would like to use cookie session store.

The problem is that when he gets redirected, he still is an anonymous  
user. This is because when he logs in at [site1.com.mainsite.com](http://site1.com.mainsite.com), the  
session gets set for [site1.com.mainsite.com](http://site1.com.mainsite.com) and not for [www.site1.com](http://www.site1.com)

Do you know of a solution around that or is it impossible to solve?

I wanted to set session[:domain] but I get a request forgery error.

---

<div class="post-metadata">

**Author:** ![fipa](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/9e8a1a/32.png) [@fipa](https://www.ruby-forum.com/u/fipa)\
**Post date:** [October 22, 2008, 12:18am UTC](https://www.ruby-forum.com/t/re-using-session-data-over-different-domain-names/151474/2 "2008-10-22T00:18:40Z")

</div>

Crap, by laying back, I just figure out, that what I am trying to do is  
a kind of XSS attack.

---

<div class="post-metadata">

**Author:** ![fipa](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/9e8a1a/32.png) [@fipa](https://www.ruby-forum.com/u/fipa)\
**Post date:** [October 22, 2008, 12:18am UTC](https://www.ruby-forum.com/t/re-using-session-data-over-different-domain-names/151474/3 "2008-10-22T00:18:40Z")

</div>

Fernando P. wrote:

> The problem is that when he gets redirected, he still is an anonymous  
> user. This is because when he logs in at [site1.com.mainsite.com](http://site1.com.mainsite.com), the  
> session gets set for [site1.com.mainsite.com](http://site1.com.mainsite.com) and not for [www.site1.com](http://www.site1.com)
> 
> Do you know of a solution around that or is it impossible to solve?
> 
> I wanted to set session[:domain] but I get a request forgery error.

You could use an iframe so that the login is made in [mainsite.com](http://mainsite.com)’s  
cookie domain.

Or your redirect could include username and password parameters,  
suitably hashed and/or encrypted.

–  
Rails Wheels - Find Plugins, List & Sell Plugins -  
[http://railswheels.com](http://railswheels.com)

---

<div class="post-metadata">

**Author:** ![fipa](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/9e8a1a/32.png) [@fipa](https://www.ruby-forum.com/u/fipa)\
**Post date:** [October 22, 2008, 12:27am UTC](https://www.ruby-forum.com/t/re-using-session-data-over-different-domain-names/151474/4 "2008-10-22T00:27:06Z")

</div>

> Or your redirect could include username and password parameters,  
> suitably hashed and/or encrypted.

I like this idea very much. Thank you for the tip.