How to share session among Multiple Domains on single asp.net website?

Question

I want to share session cookie among domains.

I have more than one domain: -

1. mydomain.com
2. mydomain.fr
3. mydomain.de
4. mydomain.da
...and many other language based

Now, I have single website deployed on a server. I want to share session among the different domains on the single website. How do I achieve this?

I found on web <httpCookies domain=".mydomain.com" /> but it work with sub domains (like test.mydomain.com and secure.mydomain.com) but not for the different domains.

I also tried <httpCookies domain=".mydomain." /> but by this session stopped working.

Could anyone help me please?

score 1 · Accepted Answer · answered May 21 '11 at 06:22

1

You can't share cookies on domains that have different top level domain name.

This is only possible to do with subdomains.

mydomain.com
fr.mydomain.com
de.mydomain.com
da.mydomain.com
...

answered May 21 '11 at 06:22

Oded

489,969
99
883
1,009

Yes, it works. But is there any possible way to share data among multiple domains? – Waqas Raja May 28 '11 at 02:02
1

@Waqas - of course there are, using back channels (same DB, for example). – Oded May 28 '11 at 05:43

score 0 · Answer 2 · edited Jun 20 '20 at 09:12

As Oded states you cannot share cookies across different top level domains. Therefore you may need to look into a different method of persisting sessions.

Swapping the Session State provider as danyolgiax proposes will not solve your issue as the session identification is still happening with cookies. Therefore you need to look into an approach such as cookieless sessions:

Cookieles sessions

Then you may choose to store the data in a Database or InProc session on server. Once you've removed the dependency on cookies.

Edit

Additionally then, if you some clientside activity using a non-auth cookie that absolutely requires the cookies to be present you would write them from each different domain based on these server/session stored values. So a user switching domains eventually gets your cookie for each domain.

CookieLess session make session id inside the query string which is not feasible in my current project. — Waqas Raja, May 28 '11 at 01:59

score 0 · Answer 3 · answered Sep 29 '11 at 05:00

You cannot share a cookie between different domain directly. But there is one way to make it possible at some context. You can make JSONP request or loading an iframe in your JS. if you use iframe make a http POST call using form. Form tag has your another domain name as action and iframe name as a target. What form will do is it will load an ifram and the cookie of your different domain will come in your browser.

Code:

<iframe name="iframe-test" border="1px"></iframe>

<form id="iframe-form" target="iframe-test" action="http://differentdomain.com/setCookie" method="POST">
     <input type="hidden" value="1234" name="token">
   </form>

    <script type="text/javascript">
        function submitForm(){          
            var form = document.getElementById("iframe-form");
            form.submit();              
        }
    </script>

score -2 · Answer 4 · answered May 21 '11 at 06:26

-2

If you are using SQL Server, I think you can use it as session state provider.

in web.config:

<sessionState 
        mode="SQLServer"
        sqlConnectionString="data source=127.0.0.1;user id=<username>;password=<strongpassword>"
        cookieless="false" 
        timeout="20" 
/>

Here some doc:

http://msdn.microsoft.com/en-us/library/ms178581.aspx

answered May 21 '11 at 06:26

danyolgiax

12,798
10
65
116

Yes SqlServer could be used but the problem is where do I store SessionID? – Waqas Raja May 28 '11 at 02:00
I think you can use Session.SessionID property. – danyolgiax May 28 '11 at 07:39
Using sessionState mode="SQLServer", Session object will be saved to SqlServer and you'll be able to share it among domains. – danyolgiax May 28 '11 at 08:16
1

but the session id is part of the cookie.. sql server is just a storage of the session on server, but you need to retrieve it based on the sessionID sent with the request. So this won't really help. – Václav Holuša Nov 22 '19 at 15:46

How to share session among Multiple Domains on single asp.net website?

4 Answers4

Linked