多个域的 PHP Cookie

Question

一旦用户在 PHP 中注册，我想从一个域创建一个 cookie。并使 4 个其他域(不是子域)可以访问此 cookie。我知道 cookie 并非设计为可供其他域访问。例如，我在域 www.firstdomain.com 中设置了一个 cookie 变量 $user_email，并希望在其他域(如 www.seconddomain.com、www.thirddomain.com 等)中访问它。可能这可以使用 PHP 或 JavaScript 完成。请有任何想法。

谢谢!

Answer 1

When searching the cookie list for valid cookies, a comparison of the domain attributes of the cookie is made with the Internet domain name of the host from which the URL will be fetched. If there is a tail match, then the cookie will go through path matching to see if it should be sent. "Tail matching" means that domain attribute is matched against the tail of the fully qualified domain name of the host. A domain attribute of "acme.com" would match host names "anvil.acme.com" as well as "shipping.crate.acme.com". Only hosts within the specified domain can set a cookie for a domain and domains must have at least two (2) or three (3) periods in them to prevent domains of the form: ".com", ".edu", and "va.us". Any domain that fails within one of the seven special top level domains listed below only require two periods. Any other domain requires at least three. The seven special top level domains are: "COM", "EDU", "NET", "ORG", "GOV", "MIL", and "INT".

The default value of domain is the host name of the server which generated the cookie response.

阅读here .

您可以从主机加载 iframe，然后它会使用段部分(# 之后)中的编码 cookie 值重新加载自身。

然后您可以从父窗口访问 document.location 属性(点击唯一可访问的内容)。对其进行解码并通过 ajax 请求将其传递给您的服务器。

这可能看起来像这样。

xss.php(位于 cookies.example.com 上):

<?php
$data = array(
'uid' => $_COOKIE['uid'],
'loginhash' => $_COOKIE['loginhash']);
header('Location: xss.php#'.urlencode(json_encode($data)));

对于这种特殊情况，它不需要是主题标签!它只是方便其他情况。这也可以在 javascript 中完成。

另一个网站嵌入了 xss.php:

<iframe id="cookies" src="http://cookies.example.com/xss.php"></iframe>

you need to somehow delay the following of do it in a loop that stops after 5 seconds or something.

if(document.getElementById('cookies').location != 'http://cookies.example.com/xss.php') {
 // read location, extract hashtag, json decode using javscript, there you have your user. send it to server for validation or whatever.
}

这种技术称为 xss 接收。例如，facebook 将其用于其所有 javascript 连接库。

可能更好的方法是某种 token 交换协议(protocol)，例如 openid。

亚马逊也在使用它。

您可以设置一个 openid 提供程序(有可用的库可以开箱即用)并将其设置为自动重定向回而无需用户交互。我经常看到 openid 协议(protocol)用于其他一些目的，例如跨域通信。