How to Set Cross Domain Cookie using Redirect?

Question

everyone

I have two websites www.web1.com and www.web2.com. Now I want to write a cookie in web1 and make it write to web2 by Response.Redirect. If it works I want to implement a simple sso through this approach. However, I can't read the cookie in web2. Could somebody help me to find out whether there's something wrong with my code or cookies can't be shared cross domain by this way. thanks:)

here's the code:

in www.web1.com/Default.aspx

protected void Page_Load(object sender, EventArgs e)
{
    HttpCookie ck = new HttpCookie("userid", "00000001");

    ck.Expires = DateTime.Now.AddDays(1);

    ck.Domain = ".web2.com";

    Response.Cookies.Add(ck);

    Response.Redirect("http://www.web2.com/Default.aspx");
}

and code in www.web2.com/Default.aspx

protected void Page_Load(object sender, EventArgs e)
{
    if (Request.Cookies["userid"] != null)
    {
        lbCookie.Text = Request.Cookies["userid"].Value;
    }
    else
    {
        lbCookie.Text = "No Cookies";
    }
}

Have you looked at the answers (especially @aleemb's answer) to this question? http://stackoverflow.com/questions/939268/cross-domain-cookie-access-or-session?rq=1 — Kane, Jun 14 '12 at 03:34
find this article`http://www.codeproject.com/Articles/106439/Single-Sign-On-SSO-for-cross-domain-ASP-NET-applic` — JayOnDotNet, Jun 14 '12 at 04:36
@Jaya Prakash Rokkam, yes,I have read the article you mentioned, and what I've done here is exactly followed the method "A very basic Cross Domain SSO implementation model" in this article.However, it seems that transfer cookie by redirect didn't work in my code:( — purplewill, Jun 14 '12 at 05:51

score 3 · Answer 1 · answered May 09 '14 at 08:17

Don't bother setting cross-domain cookies, they will be blocked in most cases in all modern browsers.

Use pure HTTP GET with parameters and server-side encryption to do a cross-domain SSO.

For example, on page www.web1.com/Default.aspx you can add a hidden IFrame to some special page www.web2.com/sso.aspx?userid=<encrypted,timestamped userid> which in turn would set the cookie on web2.com.

How to Set Cross Domain Cookie using Redirect?

1 Answers1