跨两个命名域共享会话 cookie
我有一个具有以下域的 .net Web 应用程序： www.domain.com 子域名.com files.domain.com
当用户登录到domain.com 或sub.domain.com 时，我希望他们共享会话状态（即同时登录到两个域）。这可以通过将会话 cookie 上的域设置为“.domain.com”来实现。 但是，我的问题是，由于安全问题，域“files.domain.com”不应该具有会话状态（来自该域上托管的用户创建文件的 xss 攻击是一个问题）。
在 ASP.NET 中，是否可以对这两个域使用相同的 asp.net 会话 ID，但不能对第三个域使用相同的 ASP.NET 会话 ID？
提前致谢！
I have a .net webapplication with the following domains:
www.domain.com
sub.domain.com
files.domain.com
When a user is logged on to domain.com or sub.domain.com, I'd like them to share session state (i.e. be logged into both domains at once). This is possible to do by setting the domain on the session coookie to be ".domain.com".
However, my problem is that the domain "files.domain.com" should not have session state due to security issues (xss attacks from user-made files hosted on that domain is an issue).
Is it possible in ASP.NET to use the same asp.net session id for these two domains, but not the third one?
Thanks in advance!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
以下是我想到的几个选项：
#1 - 通过客户端脚本将登录请求发布到两个应用程序。这将使您能够同时为两个有效域设置 cookie。这使您能够通过为您希望对用户进行身份验证的特定域创建 cookie 来避免您担心的 XSS 问题。
#2 - 将您的“不安全”站点移至其他域。例如：www.domain-files.com。通过该选项，您可以使用共享 cookie 来管理身份验证。
Here are a couple of options that come to mind:
#1 - Post your login request to both applications via a client side script. This will enable you to set cookies for both valid domains at the same time. This enables you to avoid the XSS issue that you are concerned about by creating cookies for the specific domains that you want to have your users authenticated on.
#2 - Move your "unsecure" site to a different domain. For example: www.domain-files.com. With that option you could use a shared cookie to manage authentication.
不要混淆会话 cookie 和表单身份验证 cookie。 ASP.NET Session 不能在应用程序之间共享。就表单身份验证 cookie 而言，它只是一个简单的 cookie，cookie 的工作方式是通过设置
domain属性。我能想到的实现此目的的一种方法是在中定义特殊的 machineKeys两个应用程序的
web.config。这样，在www.domain.com上进行身份验证的用户将收到一个 cookie，该 cookie 将使用www.domain.com的机器密钥进行加密，并且因为只有sub .domain.com具有相同的密钥将能够解密 cookie。 Cookie 仍会发送到files.domain.com，但无法解密，用户也不会在那里进行身份验证。Don't confuse session cookies and forms authentication cookies. ASP.NET Session cannot be shared between applications. As far as the forms authentication cookie is concerned, well it is just a simple cookie and the way cookies work is by setting the
domainproperty.One way I can think of to achieve this is to define special machineKeys in
web.configfor the two applications. This way users that authenticated onwww.domain.comwill be emitted a cookie which will be encrypted with the machinekeys ofwww.domain.comand because onlysub.domain.comhas the same keys will be able to decrypt the cookie. The cookie will still be sent tofiles.domain.combut it won't be able to decrypt it and users won't be authenticated there.在我看来，问题是为什么人们可以上传可能包含 XSS 攻击的文件？如果他们能做到这一点，他们可能会找到引起其他问题的方法。
最有可能的候选者是在您的登录页面上有一个 javascript 函数，该函数将凭据发送到其他服务器。因此，当有人登录到一个域时，javascript 函数会同时将他们登录到另一个域。
我同意 joe.liedtke 的观点，他说将 files.domain.com 移至另一个域并完全避免该问题。
To my mind the question is why can people upload files that may contain XSS attacks? if they can do this they may find ways of causing other problems.
The most likely candidate is on your login page have a javascript function that sends the credentials to the other server. so when someoe logs in to one domain the javascript function logs them in to the other domain at the same time.
I agree with joe.liedtke who says move files.domain.com to another domain and avoid the issue altogether.
试试这个：
共享 asp.net 身份验证不同子域上的不同应用程序
如下所述，只有具有匹配机器密钥的应用程序才能相互进行身份验证。因此，假设为 files.domain.com 提供了不同的机器密钥，它将无法解密会话 cookie，并且无权访问其他域
Try this:
Sharing asp.net authentication on different apps on different sub-domains
As mentioned below, only applications with matching machine keys will be able to authenticate with each other. So, assuming files.domain.com is given a different machine key it will be unable to decrypt the session cookie, and there for have no right to the other domains
也许，使用 Response.Cookies 直接在 cookie 中存储 Guid 值，然后根据该值查询数据库以获取共享身份验证信息，可以完成您的任务。
Maybe, it would accomplish your task to store a Guid value in the cookie directly using
Response.Cookies, then query your database based on that value to get shared authentication information.