Rails - Multiple top level domains and a single session/cookie

Question

Hello all,

I've been struggling with this for quite awhile and haven't been able to find a solution. I need a user to be able to view multiple top level domains with a single login.

My understanding is that this needs to be set in environment.rb and called with before_dispatch. This is what I've come up with:

require 'activesupport'
require 'dispatcher'
module ActionController
   class Dispatcher

      def set_session_domain
         ActionController::Base.session_options.update :session_domain => "#{@request.host}"
      end 

      before_dispatch :set_session_domain
   end
end

However, this does not seem to be working when I try and pull the values from session[:session_domain].

Any help is greatly appreciated.

Answer 1

Your question is not really precise enough IMHO. Do you want a single cookie for all Rails apps you have or is it within the context of a single one? If the former, you want to look at solutions using database-backed sessions or something along the line of RubyCAS to implement the CAS protocol.

Answer 2

This one is a bit tricky. Since cookies can only be assigned to (and retrieved from) the current domain ("forms.example.com", say) and parent domains (".example.com", but not ".com"), but NOT to other domains ("othersite.com"), you'll have to find yourself another solution. This has nothing to do with Rails, but with how cookies work.

EDIT: Sessions rely on a client-specific handle, stored in a cookie, which is why sessions also don't work cross-domain.

This site has one possible solution for creating a cross-domain cookie, and it's the cleanest way I know of, although it may have some security implications. A more complicated version would have the servers communicate directly through some secure channel.

If you're looking for a more general-purpose single-login service, try implementing some form of OpenID.

Answer 3

Thank you for the input.

Oliver, I will check out RubyCAS but I'm pretty sure that I am going to have to do something with subdomains instead of top-level domains.

Thanks again.

Answer 4

You will probably need something like RubyCAS if you want authentication across domains regardless of whether they're top-level or subdomains.

Answer 5

For rails 2+ you can just put something like:

# make cookies cross subdomains
ActionController::Base.session_options[:session_domain => '.yourdomain.com']

in your environment file

Hope that works!

-- BP

Answer 6

Both Keltia and zuk are right, Answer is rubyCAS, We have do that integration and it allows

SSI - Single sign -in You sign to one site and you are automatically signed to the other

SSO - Single Sign Out You sign out from one site and automatically you signed out from the other

For us this is a proven solution and not a hard one to implement

we are using it in http://www.cabslk.com and www.ticketslk.com

cheers, Sameera

Answer 7

For sub-domains in Rails 2.3

ActionController::Base.session = { :domain => ".mydomain.com" }

For top-level domains try this middleware.

I've been playing with the above middleware at the moment and it does not quite work as expected. If you do use the middleware you do not need the above code as it handles sub-domains as well.