2

I am working on a login system that I want to work like this:

Attempt to post when not logged in pops up an alert with u/p fields -> submit u/p ajax hits login route -> successful login sets 'logged in' cookie -> attempt to post again now succeeds. all without a page reload.

It seems I have hit a roadblock though with all this CORS/cross-domain-access-control because I am using dynamic subdomains and XHR requests.

You could be anywhere.mysite.com and have to ajax crossdomain to user.mysite.com/login to login.

In order for login() to be allowed to set the cookie you have to specify your origin (no '*' wildcard), set a 'Access-Control-Allow-Credentials = true' header, and submit the ajax with a 'xhrFields: {'withCredentials': true}' parameter. I can get this to work.

My problem is the dynamic domains. Its not possible to set every possible subdomain in the accepted Origins list. Is there any possible way to have it accept .mysite.com as the origin so all subdomains.mysite.com pass?

This post lists the possibility of setting the document.domain = "company.com"; in an iframe to achieve this kind of functionality, but i'm not sure where in my login flow above i would insert an iframe or how that would even work...

Any thoughts?

Community
  • 1
  • 1
chrickso
  • 2,994
  • 5
  • 30
  • 53
  • Are you writing the application or are you just handling the front-end posting to the login route? – lewiguez Jul 12 '12 at 13:08
  • i'm writing it. with flask on heroku – chrickso Jul 12 '12 at 13:09
  • I'm not super familiar with those, which is why I'm not putting this as a full answer, but is it possible to manually set the "Access-Control-Allow-Origin" header from your application if the request is coming from a whitelist of approved domains? So, instead of trying to do this on the front-side, you would post from your current subdomain and the server-side code would check the origin and if it matches something in a list of approved sources, it would respond with that subdomain. – lewiguez Jul 12 '12 at 13:21

0 Answers0