How can I share a cross site cookie?

Kyansittha 0
Viewed 26

I have the following code on example1.com:

<?php
setcookie('_ch' , base64_encode($file) , time() + (60) , '/');
header("Location: http://example2.com/");
exit();

And on example2.com:

<?php
if (!isset($_COOKIE['_ch'])){
    echo error::noocookie();
    exit();
}

The problem I face is that the if statement is always true. How can I access the cookie from example2.com?

php
1 Answers

You can't. A website isn't allowed to set cookies for other domains.

See the specification. Specifically point 6 of the storage model section.

If the canonicalized request-host does not domain-match the domain-attribute:
Ignore the cookie entirely and abort these steps.

and the domain-match section:

A string domain-matches a given domain string if at least one of the following conditions hold:

  • The domain string and the string are identical. (Note that both the domain string and the string will have been canonicalized to lower case at this point.)
  • All of the following conditions hold:
    • The domain string is a suffix of the string.
    • The last character of the string that is not included in the domain string is a %x2E (".") character.
    • The string is a host name (i.e., not an IP address).

With a domain of example2.com and a request-host of example1.com, none of these conditions are true.

useraZ40
Related