Skip to content

cookie_domain with multiple domains and wildcards #9744

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wholehogsoftware opened this issue Dec 11, 2013 · 9 comments
Closed

cookie_domain with multiple domains and wildcards #9744

wholehogsoftware opened this issue Dec 11, 2013 · 9 comments

Comments

@wholehogsoftware
Copy link

We have a 'white label' system in place where our system responds to multiple domains. For example:

customer-1.com
customer-2.com

We use a kernel event listener to catch the current domain and show specific assets and content which allows each client to customize the platform.

Then, we have an affiliate program that allows partners to refer users using a vanity URL. For example:

partner-1.customer-1.com
partner-2.customer-2.com

The issue we have run into is that, in order to use wildcards in our cookie domain, we must set cookie_domain in config.yml which means we are limited to using a single domain.

Is there a different way to handle this?

A workaround would be to redirect the user twice but I would like to avoid that. The first redirect would take them from partner-1.customer-1.com to the main customer-1.com and then the cookie would be set without specifically setting cookie_domain. Once that is done, the user could be redirected to the requested route/URI. The result is that the default behavior of using the current domain as the cookie_domain would then take over.

@mvrhov
Copy link

mvrhov commented Dec 12, 2013

This could have been solved with the expressions in 2.4 but sadly they are not supported inside config files. #9658

@wholehogsoftware
Copy link
Author

Yeah, I understand why though. At least, in my case, there's a pretty simple workaround (the one I mentioned above) so it becomes a trivial problem. I see potential issues with it, like the ones you pointed out in your link, which require a lot more work to get around.

@bmeynell
Copy link

bmeynell commented Aug 2, 2014

👍 I've also been looking for an elegant way to do this. As a workaround I've been setting the cookie domain in the front controller (e.g., app.php):

// Dynamic session domain support                                                         
session_name($some_name);                                                           
session_set_cookie_params (2678400, '/', $some_domain, false, true);

@bmeynell
Copy link

bmeynell commented Aug 2, 2014

Also see a related comment here --> opensky/OpenSkyRuntimeConfigBundle#10 (comment)

@nicolas-grekas
Copy link
Member

Closing as this should be solvable with environment variables now. Please report back if not.

@aistis-
Copy link

aistis- commented May 20, 2019

Hi @wholehogsoftware

How did you solve case? I have a similar one. As I don't want to expose a session to other white-label by any means, I am probably going to write a custom session handler. I am using MySQL for storing the session, so will add an extra column which will contain a session domain or WL identifier 🤔

@mathroc
Copy link
Contributor

mathroc commented Jul 4, 2019

I'm interested to. @nicolas-grekas I don't see how environment variables are helping here, do you mean we should have different environment variables per vhost ?

@boosen
Copy link

boosen commented Jul 28, 2023

Hi @wholehogsoftware

How did you solve case? I have a similar one. As I don't want to expose a session to other white-label by any means, I am probably going to write a custom session handler. I am using MySQL for storing the session, so will add an extra column which will contain a session domain or WL identifier 🤔

I encounter same problem recently, I solved this case with response subscriber and it seems work fine for me:

$cookieDomain = $this->getCookieDomain($request->getHost());
$cookies = $response->headers->getCookies();
if (($cookieDomain != $request->getHost()) && !empty($cookies)) {
    foreach ($cookies as $cookie) {
        if ($cookie instanceof Cookie && $cookie->getDomain() != $cookieDomain) {
            $newCookie = Cookie::create(
                $cookie->getName(),
                $cookie->getValue(),
                $cookie->getExpiresTime(),
                $cookie->getPath(),
                $cookieDomain,
                $cookie->isSecure(),
                $cookie->isHttpOnly(),
                false,
                $cookie->getSameSite()
            );

            $response->headers->setCookie($newCookie);
            $response->headers->removeCookie($cookie->getName(), $cookie->getPath(), $cookie->getDomain());
        }
    }
}

Please note that the event priority must be less than -1000 (the session listener):

    public static function getSubscribedEvents(): array
    {
        return [
            ResponseEvent::class => [
                ['onKernelResponse', -1024]
            ]
        ];
    }

With this solution, no need to create new session handler.

@wholehogsoftware
Copy link
Author

wholehogsoftware commented Jul 28, 2023

@boosen I don't remember. The original comment is a decade old and I haven't used Symfony in years. Sorry I can't be of more assistance!

Edit: Oh, I see. You're proposing a solution. Crazy to see this is still a thing a decade later!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

8 participants