For this answer I've made a few assumptions:
- The user has to enter there credentials at least once on each domain (any other way would be a serious security issue)
- You have access to either a database or file space outside the web root.
- sub-domain, domain or any other name will be referenced as "site"
- The aim is to have a common file (physical file or serialized in database) accessible from each site/domain.
For my example I will be using a database, since it's the idea I'm putting across, not database/file access techniques, I will have unnecessary lines removed, IE: How to connect to the database.
If this concept is what you were after, or if anyone else want me to fill in the blanks for completeness, just leave a comment. On with the code.
I would take a completely different approach.
From what I gather from your question, and the related post you linked to, you are trying to share a session using a common session name.
- Each site has it's own session id.
- Each site has it's own authentication cookie ( $_COOKIE['userid'] or $_COOKIE['userhash'] ).
- Individual sessions are created, and a common cookie is stored on each site.
-
- Using a custom session handler each site reads the same data.
class MySessionHandler implements SessionHandlerInterface
- My after thought was an even simpler approach, a class that acts like a session handler, reading / writing to a common file. Since php's session handler doesn't save the data until the script has ended.
Original idea - Won't go into details, it's just for reference.
class MySessionHandler implements SessionHandlerInterface {
private $savePath;
public function read($id) {
$id = some_user_authentication_function();
$hash = $_COOKIE['_h'];
$result = mysql_query("SELECT sess_data FROM login_table WHERE user_id = {$id} AND hash = {$hash}");
return $result['sess_data'];
}
public function write($id, $data) {
$id = some_user_authentication_function();
$hash = $_COOKIE['_h'];
$result = mysql_query("UPDATE login_table SET sess_data = {$data} WHERE user_id = {$id} AND hash = {$hash}");
return ($result === false) ? false : true;
}
}
$handler = new MySessionHandler();
session_set_save_handler($handler, true);
session_start();
class customSessionHandler
{
private $hash;
private $id;
private $sess_db;
public function __construct($db) {
$this->hash = $_COOKIE['hash'];
$this->id = some_user_authentication_function($this->hash);
$this->sess_db = $db;
}
public function get($key) {
$query =
"SELECT value ".
"FROM ".$this->sess_db.
"WHERE user_id = {$id} ".
" AND hash = {$hash} ".
" AND key = {$key}";
$result = mysql_query($query);
return $result['key'];
}
public function set($key, $val) {
$query =
"REPLACE INTO ".$this->sess_db.
"SET {$key} = {$val} ".
"WHERE user_id = {$id} ".
" AND hash = {$hash}";
return (mysql_query($query) === false) ? false : true;
}
}
$handler = new customSessionHandler('sess_data');
session_start();
As stated at the beginning, any code that isn't essential to explaining the concept has been removed.
Things that might not be obvious to everyone:
- $key and $val need to be sanitized before sending to the database. (prevent injection attacks)
- The hash gets sent to your login functions, so the hash can be used to clear the session data when needed, can also be used in the authentication of the user.
- mysql prepared statements would be ideal here, so you can prepare the two queries in the constructor, then you just reuse the statement on every call. Then put the connection close code in the destructor.
After thought
There would be much greater security if each site had it's own hash.
Then if you detect a security anomaly, you can just block or re-request the credentials from the one site, without compromising the hash for the network of sites.
To implement this would be as easy as setting up another table containing:
- user_id
- site_name (example.com)
- hash
- timeout
- re-authenticate
and modifying the session_data table, so instead of accessing the $key => $val pair by hash, you access it by user_id.
Thanks for reading, hopefully it will be of use to someone.
