# Share Authentication Cookies

**URL:** <https://www.ruby-forum.com/t/share-authentication-cookies/141549>\
**Category:** Ruby\
**Created:** [June 26, 2008, 11:49pm UTC](https://www.ruby-forum.com/t/share-authentication-cookies/141549 "2008-06-26T23:49:22Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![staypufd](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ecd19e/32.png) [@staypufd](https://www.ruby-forum.com/u/staypufd)\
**Post date:** [June 26, 2008, 11:49pm UTC](https://www.ruby-forum.com/t/share-authentication-cookies/141549/1 "2008-06-26T23:49:22Z")

</div>

I would like to know if it is possible to share Authentication cookies  
between 2 url’s with ruby. Does anyone know how to?

thanks

---

<div class="post-metadata">

**Author:** ![staypufd](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ecd19e/32.png) [@staypufd](https://www.ruby-forum.com/u/staypufd)\
**Post date:** [June 27, 2008, 3:26pm UTC](https://www.ruby-forum.com/t/share-authentication-cookies/141549/2 "2008-06-27T15:26:49Z")

</div>

You can set the ‘domain’ (like: .example.org) and ‘path’ (like: /)  
arguments  
to the cookie. This will make the browser to send the same cookie on  
different domains and paths.

The ruby cgi library supports this.

See:

[http://ruby-doc.org/stdlib/libdoc/cgi/rdoc/index.html](http://ruby-doc.org/stdlib/libdoc/cgi/rdoc/index.html)

> **[HTTP cookie | Cookie attributes](https://en.wikipedia.org/wiki/HTTP_cookie#Cookie_attributes)**
>
> In addition to a name and value, cookies can also have one or more attributes. Browsers do not include cookie attributes in requests to the server—they only send the cookie's name and value. Cookie attributes are used by browsers to determine when to delete a cookie, block a cookie or whether to send a cookie to the server.

martin

---

<div class="post-metadata">

**Author:** ![staypufd](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ecd19e/32.png) [@staypufd](https://www.ruby-forum.com/u/staypufd)\
**Post date:** [June 27, 2008, 4:44pm UTC](https://www.ruby-forum.com/t/share-authentication-cookies/141549/3 "2008-06-27T16:44:28Z")

</div>

Martin B. wrote:

> You can set the ‘domain’ (like: .example.org) and ‘path’ (like: /)  
> arguments  
> to the cookie. This will make the browser to send the same cookie on  
> different domains and paths.
> 
> The ruby cgi library supports this.
> 
> See:
> 
> [http://ruby-doc.org/stdlib/libdoc/cgi/rdoc/index.html](http://ruby-doc.org/stdlib/libdoc/cgi/rdoc/index.html)  
> [HTTP cookie - Wikipedia](http://en.wikipedia.org/wiki/HTTP_cookie#Cookie_attributes)
> 
> martin

is this valid for to completely different url’s

---

<div class="post-metadata">

**Author:** ![staypufd](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ecd19e/32.png) [@staypufd](https://www.ruby-forum.com/u/staypufd)\
**Post date:** [June 28, 2008, 12:32am UTC](https://www.ruby-forum.com/t/share-authentication-cookies/141549/4 "2008-06-28T00:32:25Z")

</div>

No, this is a http restriction implemented at the user agent (browser).

RFC 2109:  
8.3 Unexpected Cookie Sharing

A user agent should make every attempt to prevent the sharing of  
session information between hosts that are in different domains.  
Embedded or inlined objects may cause particularly severe privacy  
problems if they can be used to share cookies between disparate  
hosts. For example, a malicious server could embed cookie  
information for host [a.com](http://a.com) in a URI for a CGI on host [b.com](http://b.com). User  
agent implementors are strongly encouraged to prevent this sort of  
exchange whenever possible.

---

<div class="post-metadata">

**Author:** ![staypufd](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ecd19e/32.png) [@staypufd](https://www.ruby-forum.com/u/staypufd)\
**Post date:** [June 27, 2008, 11:49pm UTC](https://www.ruby-forum.com/t/share-authentication-cookies/141549/5 "2008-06-27T23:49:14Z")

</div>

Martin B. wrote:

> You can set the ‘domain’ (like: .example.org) and ‘path’ (like: /)  
> arguments  
> to the cookie. This will make the browser to send the same cookie on  
> different domains and paths.
> 
> The ruby cgi library supports this.
> 
> See:
> 
> [http://ruby-doc.org/stdlib/libdoc/cgi/rdoc/index.html](http://ruby-doc.org/stdlib/libdoc/cgi/rdoc/index.html)  
> [HTTP cookie - Wikipedia](http://en.wikipedia.org/wiki/HTTP_cookie#Cookie_attributes)
> 
> martin

is this valid for two completely different url’s sharing the same  
database i:e [www.whatever.com](http://www.whatever.com) and [www.myurl.com](http://www.myurl.com)