sharing cookies between websites

user_3840442 0
Viewed 453

I am referring to below tutorial to share cookies between 2 different MVC applications running locally,

https://docs.microsoft.com/en-us/aspnet/core/security/cookie-sharing?view=aspnetcore-5.0

BaseApp2 : ruuning at https://localhost:44363/ has below configuration

 public void ConfigureServices(IServiceCollection services)
    {
        DirectoryInfo di = new DirectoryInfo(@"C:\SharedCookies");
        services.AddDataProtection()
        .PersistKeysToFileSystem(di)
        .SetApplicationName("SharedCookieApp");

        services.ConfigureApplicationCookie(options =>
        {
            options.Cookie.Name = ".AspNet.SharedCookie";
        });

        services.AddAuthentication(options =>
        {
            options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
            options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
            options.DefaultChallengeScheme = CookieAuthenticationDefaults.AuthenticationScheme;
        })
          .AddCookie(options =>
          {
              options.LoginPath = new PathString("/Account/SignIn");
          })
          .AddOktaMvc(new OktaMvcOptions
          {
              // Replace these values with your Okta configuration
              OktaDomain = Configuration.GetValue<string>("Okta:OktaDomain"),
              ClientId = Configuration.GetValue<string>("Okta:ClientId"),
              ClientSecret = Configuration.GetValue<string>("Okta:ClientSecret"),
              AuthorizationServerId = Configuration.GetValue<string>("Okta:AuthorizationServerId"),
              Scope = new List<string> { "openid", "profile", "email" },

          });
        services.AddControllersWithViews();
    }

And Subapp1 which should reuse baseapp2 cookies running at https://localhost:44309/ has below configuration,

 public void ConfigureServices(IServiceCollection services)
    {
        DirectoryInfo di = new DirectoryInfo(@"C:\SharedCookies");
        services.AddDataProtection()
        .PersistKeysToFileSystem(di)
        .SetApplicationName("SharedCookieApp");

        services.ConfigureApplicationCookie(options =>
        {
            options.Cookie.Name = ".AspNet.SharedCookie";
            options.Cookie.Path = @"C:\SharedCookies";// "/";
        });

        services.AddControllersWithViews();
    }

When I login into baseapp2 successfully i could see could see cookie is creating in it's domain. And also it is saved to physical path mentioned in there. But am unable to login to second application using that cookie?

Is anything am missing? Please help.

attached screenshots

enter image description here

enter image description here

model-view-controller authentication cookies .net c#
4 Answers

Two different domains (e.g. mydomain.com and subdomain.mydomain.com, or sub1.mydomain.com and sub2.mydomain.com) can only share cookies if the domain is explicitly named in the Set-Cookie header. Otherwise, the scope of the cookie is restricted to the request host. (This is referred to as a "host-only cookie". See What is a host only cookie?)

Your URLs are different!

You can use virtual directory in IIS or Sub Domain.

All modern browsers respect the newer specification RFC 6265, and will ignore any leading dot, meaning you can use the cookie on subdomains as well as the top-level domain.

user_106851630

You have strange Path value for the cookie:

The Path property specifies the subset of URIs on the origin server to which this Cookie applies. If this property is not specified, then this Cookie will be sent to all pages on the origin server or servers.

  • probably you'll want / for both sites.
  • maybe also specifiy same cookie domain (not necessary in dev, maybe in production, depending how the apps are deployed).
user_1150780

Remove options.Cookie.Path = @"C:\SharedCookies";// "/"; line from subapp1 Or Add it to the base app configuration.

I have done a similar thing and I did not require to specify cookie path explicitly.

user_33822760

You can try this approach:

Create a file that sets the cookie on all 3 domains. Then create a HTML file that would load the files that sets cookie on the other 2 domains. Example:

<html>
   <head></head>
   <body>
      <p>Please wait.....</p>
      <img src="http://domain2.com/setcookie?theme=1" />
      <img src="http://domain3.com/setcookie?theme=2" />
   </body>
</html>

Then add an onload callback on body tag. The document will only load when the images completely load that is when cookies are set on the other 2 domains.

If you can create this functionality in C#, then you can share cookies between websites

user_164413300
Related