Single session in two different domains

Question

Hi Guys,

I am proposing a design for my company in integrating 4 systems together and putting it into web. All the 4 systems are independent of each other but I am trying to integrate to have more automation. One of the system is as follows : I want to link my companies website (www.xyz.com) to another website (www.abc.com) with same login session. Consider this way,

1. Person X logs on to www.xyz.com
2. Person X fills a request form on www.xyz.com
3. when he clicks submit request, this request should be forwarded to www.abc.com with the same loggin session without the person X knowing that he has been rediredted to another website. Also I want to retrieve the data on www.abc.com using the same session on www.xyz.com and send a download link to Person X to download the data that was generated on www.abc.com

How is this possible. I do not need the coding details. I need someone to help in with this implementation details. Thanks

Regards Kunal

Answer 1

The only way to accomplish cross-domain sessions is to use a unique identifier associated with each user's account. The concept here is to generate a hash that is unique to that user's account and pass it via the URL to the destination. The new site will then auto log in the user based on this hash. Once they're logged in, a new one is generated and replaces the old one.

On the user side, this will "carry" the login over multiple sites. If you actually need to carry data over then you'll need to store it in a database.

Other layers of security for the auto login can include browser-agent checks as well as IP checks. If any of this information changes, it's a different computer and you shouldn't log them in.

I used this method on SC-Source.com to carry a login between the various sites.

Answer 2

One thought I have, perhaps not the best way, is to have a shared iframe, beacon, etc. So both xyz.com and abc.com would have a pair of iframes or beacon image whose URL contains a session key:

<iframe src="http://www.abc.com/beacon?id=3a9c82904dd23f4" height="1" width="1" frameborder="0" frameborder="off" border="0"></frame>
<iframe src="http://www.xyz.com/beacon?id=3a9c82904dd23f4" height="1" width="1" frameborder="0" frameborder="off" border="0"></frame>