Cross domains sessions - shared shopping cart cros

Question

we are solving the problem with eshop (php, mysql). The client want to have the same eshop on two domains with shared shopping cart. In the shop customer can do the shopping without users account (can't be logged in). And there is the problem, how to make the shared shopping cart cross domain.

The data from cart is stored in sessions, which we stored in database too. But we can't solve the problem in carrying data over domains. Identifying unlogged user is not holeproof (research).

The example, how it should work

Customer goes to domainOne and add some things to the cart. Than he goes to domainTwo (by link, typing domain address, however) and add some other things to the cart. In the cart he has things from both domains (after refreshing page).

Do you have any idea, how to solve this problem?

What didn't work:

• redirecting is not possible due to customer requirments
• cookies are related to domain
• set_cookie with the other domain didn't work
• the simpliest way is to carry over only the sessionid (stored in cookies) but we don't know, how to wholeproof identify unlogged users.
• is there any other place, where data can be stored on client side except cookies? (probably not)
• we can't use sending sessionid by params in url (if user click to link to the other domain) or resolving the header referer, bcs we don't know, how user can achieve the other domain.

If you can't understand me, take me a question. If you think, that having eshop on two domains with shared (common) cart is bad idea, don't tell me, we know it.

Thanks for each answer.

Answer 1

easyXDM is a framework that allows the user to easily work around the Same Origin Policy. Its built-in RPC feature is very easy to use, and you should be up in running in no-time.

For your case, select one of the domains to be the 'checkout'-domain (A) - this is the domain that will keep the session stored. On the same domain you create a small file with an easyXDM endpoint that is responsible for storing/retrieving the data sent from the other domain (B).

Now, in domain B, you include easyXDM and when storing/retrieving data from the cart, you access the RPC methods instead.

Answer 2

What about something like this, not sure how good it would be though.

User goes to store1. If user does not have a session cookie, redirect to a special page on store2 asking for the session id and sending the url on store1 to return to. The special page looks at the session cookie and redirects back to the original url on store1 with the session id (like the answer by @symcbean). Then on store1, the session cookie gets set(or created new) and no more redirecting happens. And then the same but oposite if the user is on store2 with no session cookie.

But if the user does not have cookies enabled, I can see an infinite loop happening. Not sure if it would be possible to detect and stop somehow.

But this way would be hacky at best.

Answer 3

1) Obviously, use the same session-store for both domains (files, database, memcached, the usual suspects.
2) If after session_start() the $_SESSION is empty, create an 'all domains' array in the session (do this on every domain, regardless which one it is, ).

$_SESSION['all_domains'] = array(
    'domain1.com'  => true, //<= current domain the customer is on,
    'domain2.com'  => false, //other domain, no cookie for it yet.
    'domain2.com'  => false); //repeat for all domains needed

3) Create a session-setter script on all domains (let's call it 'sesset.php':

 <?php
     if(isset($_GET['sessid']){
          session_id($_GET['sessid']);
          session_start();
          //also, check here for the domains:
          if(!isset($_SESSION['all_domains'])){
              //set the array as before, flag this domain as true.
          } else {
              $_SESSION['all_domains'][$_SERVER['HTTP_HOST']] = true;
              //you might want to set a custom domainname instead of HTTP_HOST, so you won't get doubles from domain with & without www. and so on.
          }
     }
 ?>

4) On every conceivable php HTML page, put this somewhere near the end of the body:

 <?php
     foreach($_SESSION['all_domains'] as $domain => $domainset){
         if(!$domainset){
             echo '<img src="http://'.$domain.'/sesset.php?sessid='.session_id().' width="1" height="1"/>';
         }
     }
 ?>

Not fullproof, but will get almost all users. Ofcourse, one could do it with a redirect cascade instead of 'hidden images', but searchbots (google et al.) very much get confused about it, especially if they don't remember the cookie and are stuck being redirected again & again.

Answer 4

You can use Flash LSO's for this matter i think. Normally LSO's are stored in their domain specific sandboxes, but if two domain objects allow, they can communicate as stated in the "cross-movie communication" section in http://download.macromedia.com/pub/flash/whitepapers/security.pdf. For general info about LSO's: http://www.adobe.com/products/flashplayer/articles/lso/

Answer 5

You can use a third domain to identify your customers over all domains.

Use for example a PHP File on http://thirdDomain.com/session.php that is included on all pages on both shops.

Sample:

<script type="text/javascript" src="http://thirdDomain.com/session.php"></script>

After your customer switches domains, you can identify him as the same customer using the third domain.

You can assign the session id on both shops to the session id on the third domain to access the cart on both shops. You only need to inform the third domain about your shop sessions (i.e. add them as parameter).

Depending on how flexible you are with your code and templates, you can even use an output from the third domain to define the session id in your shops. This way you can use the same session id on all domains. But normally a session id assignment should be the more secure way.

Using the javascript version you can also output scripts that may add a session id to all outgoing links and forms to the other domain in the current html page. This might be interesting if you can identify your customer as having cookies blocked. You can also use the javascript to inform the parent document about an existing session.

Answer 6

You can store data in other places than cookies (e.g. Flash cookies, localStorage) but all use same origin policy, which is the standard security model of the web: data stored by a domain can only be accessed by that domain and its subdomains. The standard workaround is to embed an iframe from the foreign domain into the page. That iframe will have access to the cookies of the foreign domain, and its url will be controlled by the local domain, which allows for communication.

A simple solution based on that is to have a table of (domainA sessionid, domainB sessionid) pairs. When a new user arrives to domainA, (new sessionid, NULL) is added to the table; the page shown to him includes an invisible iframe with source = http://domainB/mergeSessions.php?sessionA=1234. mergeSessions.php will then receive sessionA as an URL parameter and sessionB as a cookie, and update the session link table accordingly.