classic ASP - passing variables in cookies instead of sessions

[edmicman]

At work I was given a task to modify some existing classic ASP/javascript login pages. Basically I had to take an existing report that required login authentication, pass its URL to a central login page which if successful set a session variable to true, and then redirects back to the original report page so the user can view it. So far so good - my test environment works.

I ran into problems, though, when I found out the production environment has the reports on a different subdomain than the authenticating login page. Apparently session variables don't pass between subdomains? Or am I assuming wrong?

Anyway, assuming that session variables DON'T transfer between subdomains, I thought I might be able to go with cookies to transfer the authentication status between the subdomains. Can this work? When I set up the cookie, can I just set the domain property to ".mydomain.com"? I ask because that didn't seem to be working earlier when I tried it. There may or may not already be a cookie that is being used for the domain, I'm not sure. Could there be conflicts there? Maybe there's a better way to be handling this? Any thoughts or ideas? Thanks!

 

[DaveSimmons]

It's doable, with cross-site cookies like in spyware if nothing else, but I've never done it myself. I assume a path=/; isn't working?

 

[edmicman]

So am I right that session variables can't pass between subdomains? I'm pretty sure the subdomains are hosted on two different physical machines, so that would make sense....

 

[MrChad]

Cookies can pass between subdomains. If you have server1.domain.com and server2.domain.com, you MUST set the domain property in JavaScript to ".domain.com" on BOTH pages. It can be extremely tedious, but it can work.

As for passing session variables, it won't work out of the box. Each server tracks their sessions independently, so session A on server 1 is not equal to session A on server 2. It is possible to implement cross-server sessions using a central session repository (usually a database). There are performance implications with this, of course. I know ASP.NET has this capability built-in, but I'm not sure about ASP.

Text

 

[edmicman]

Thats what I thought (re cookies and subdomains) but I'm running into snags. It works the first time, but after that it doesn't. I've tried setting the domain property of the cookie to "mydomain.com", ".mydomain.com", "*.mydomain.com", and none of them seem to work. It *does* work if I explicitly set the domain to "subdomain.mydomain.com". Would it matter if they were on different physical servers? I can see the session variable being affected by that, but I thought cookies would work...

This is what I'm doing on both pages:

Response.Cookies("PHSCookie").Domain = "mydomain.org";
Response.Cookies("PHSCookie").Path = "/";
Response.Cookies("PHSCookie")("Authenticated") = Session("Authenticated");

Its supposed to login, set the session cookie, redirect to the dest page where it reads the cookie and see its authenticated, and then at the bottom of that page it sets the authentication value to "not authenticated". I want the cookies to expire with the browser session, so I'm not setting an expiration date. What am I missing here?