ansaurus

Question

ASP.NET Cross-Domain Cookies & Facebook Connect

Answer 1

A:

Could you set one of them up as your "Facebook Authentication" site, and direct all FB Auth-related traffic there, and then use one of a large number of cross-site communication tricks to send the token over to the original site?

In other words, regardless of the site they come in from, you'll use .foobar.com.au (for example) as the redirect URI. Then when they come in to that site with you having noted that they came from .foo.bar.com.au, you'll redirect them back where they came from passing along the access token in some cross-domain fashion (querystring, post vars, etc.)

Yuliy 2010-07-20 05:07:50

Could you elaborate please? Also note, im using the JavaScript API for authentication - so i need access to the cookies in the domain.

RPM1984 2010-07-20 05:20:54

@Yuliy - yeah .. i'm really confused by this answer also. Can u please elaborate on what you mean? What's *cross-site communication tricks* ?

Pure.Krome 2010-07-22 03:42:39

Cross-site communication tricks involves using some sort of mechanism for passing data from one site to another, which is something that the same origin policy is supposed to make more difficult. One technique is a cross-site POST request (aka a form submission). Another is a redirect with the access token in the query string.

Yuliy 2010-07-22 07:29:41

@Yuliy. Thanks for the clarification. I see what you're saying now. Really though, probably best to setup an independant authorization server (ie web service). Not really feasible for the timeframes i have at the moment. I dont really want to be passing querystring/post requests between servers, because that's adding a depedency on one of the servers, where really its not the job of the server. Thanks for the tips though - ill consider a better solution when we do a project refresh (which is happening soon). For now im just going to go with the multiple api keys/logic smarts.

RPM1984 2010-07-23 01:09:33

Answer 2

A:

If you want *.foobar.com.au to be allowed, then setup your Base Domain to foobar.com.au.

daaku 2010-07-20 06:02:21

Edited question - the domain doesnt always contain Foobar. This is what happens when you "overfoo" code, lol.

RPM1984 2010-07-20 10:15:51

Can I ask what's your use case for multiple base domains?

daaku 2010-07-20 17:09:12

We have mutliple versions of our website for different locales. So in australia, our domain might be australia.foo.bar.com, and in america it might be www.foobar.com.Not going to chance these domains - they have been marketed this way so cant change them now.

RPM1984 2010-07-21 05:47:36

Answer 3

A:

In my current situation, timeframes have stopped me from doing the proper solution, which is what @Yuliy has highlighted.

For now, i have created multiple Facebook applications. But to keep it DRY, i have abstracted all that away behind exposed properties:

private static string _ApiToken_Site1, _ApiToken_Site2;
public static string ApiToken
{
   get
   {
       if (Site1) return _ApiToken_Site1;
       else if (Site2) return _ApiToken_Site2;
   }
}

Not exactly clean, but the main thing is i did not have to touch my existing code at all, the smarts to work out which Api Key to use is in that property.

For our next project release, i'll be scrapping this and most likely implementing a WCF/ASMX web service which handles authentication from the one place (ie seperate web service on seperate domain).

RPM1984 2010-07-27 04:37:14

ansaurus

tags:

views:

answers:

ASP.NET Cross-Domain Cookies & Facebook Connect

related questions