将 cookie 从主域复制到子域
我的应用程序有一个用户空间，过去可以通过像domain.com/~username这样的url来访问，但我正在将其转换为使用子域（username.domain.com）。然而，我遇到了一个问题，我希望有人知道如何解决。
目前，用户网站的访问者会获取 user 形式的 Cookie（其中 authentication 的新 cookie，使用子域作为 cookie 域。但是，rails cookies 数组找不到主域cookie。
我知道，如果旧的 cookie 使用 .domain.com 作为域，它们将应用于子域并出现在 cookie 中，但这些 cookie 是已经存在，并且我正在尝试使用户的更改尽可能无缝 - 因此，如果他们已经有一个站点的身份验证 cookie，我希望他们不必重新进行身份验证（如果可能的话）。
有什么方法可以从主域获取 cookie，或者有人对如何传输 cookie 有其他建议吗？
更新：抱歉，我之前没有说清楚，只有当访问者通过在用户网站上提交表单来主动验证自己的身份时，才会设置 cookie。
My application has a userspace which used to be accessed by a url like domain.com/~username, but I am in the process of converting that to using subdomains instead (username.domain.com). However, I am running into an issue that I'm hoping someone might have an idea of how to get around.
Currently, visitors to a user's site get a cookie of the form user<id>_authentication (where <id> is the user ID of the site they're visiting), which is set to have the domain www.domain.com. However, now that I'm switching to subdomains, I want to find those cookies and transfer them to a new cookie called authentication per subdomain, using the subdomain as the cookie domain. However, the rails cookies array does not find the main domain cookies.
I know that if the old cookies were using .domain.com as the domain instead, they'd apply to the subdomain and would be present in cookies, but these cookies are already existing, and I'm trying to make the change as seamless for a user as possible -- so if they had an authentication cookie already for a site, I want them to not have to reauthenticate if at all possible.
Is there any way I can get the cookies from the main domain or does anyone have another suggestion of how I can transfer the cookies?
Update: Sorry, I didn't make it clear before, the cookie is only set if the visitor actively authenticates themselves by submitting a form on the user's site.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
如果您将 cookie 域更改为更宽松（适用于更多子域），您将无法读取旧的、更受限制的 cookie，除非来自曾经有效的顶级域。
您必须读取 cookie、进行身份验证，然后写入一个新的更宽松的 cookie，然后子域才能读取该 cookie。
您可以在该功能之前推出您的迁移逻辑，并希望您能吸引大多数人。其余的则必须手动重新进行身份验证。
If you change the cookie domain to be more permissive (applying to more sub domains) you have no way to read the old, more restricted cookies except from the top level domain that used to work.
You will have to read the cookie, authenticate, and then write a new more permissive cookie before the cookie can be read by the subdomain.
You can roll out your migration logic in advance of the feature and hope you get most people. The rest will have to re-authenticate manually.
就我个人而言，我认为他们应该重新进行身份验证..它只会发生一次，然后他们将拥有新的“.domain.com”cookie。
但是...实现此目的的一种方法是检查新的 cookie，如果找不到它，则重定向到主域上的新页面，并提供返回 url。
在该新页面中，检查旧样式 cookie，设置新样式 cookie，然后重定向到原始 url。如果他们没有旧式 cookie，则重定向到登录区域。
希望这有帮助。
Personally I think they should have to re-authenticate.. it will only happen once, then they'll have the new ".domain.com" cookie.
But... One way to achieve this would be to check for the new cookie and when failing to find it, redirect to a new page on the main domain, providing the return url.
In that new page, check for the old style cookie, set the new style cookie, and redirect to the original url. if they don't have the old style cookie, redirect to the login area.
hope this helps.