在多个子域上共享 Django 会话的缺点
我使用站点框架构建了一个 Django 站点，并在不同的子域上有四个站点。我们称它们为 one.mydomain.com； two.mydomain.com ...等。
其中三个站点是产品站点，一个是商店。我希望能够跨站点共享会话，以便用户在从任何产品站点移动到商店时不必再次登录。我意识到我可以使用 cas 来实现单点登录，但我不认为这满足了我所有的目的。
我已阅读这篇文章和这篇文章关于跨域共享会话子域和共识似乎是这是一个坏主意。
就我而言，我希望用户能够将商品添加到一个子域的购物车中，然后进入购物车结账。如果不共享会话，我看不出有什么方法可以做到这一点。用户还应该能够从另一个产品网站添加到他们的购物车，并且在结帐时会看到来自 one.mydomain.com 的产品、来自two.mydomain.com 等的产品。
所以我的问题是为什么共享会话是一个坏主意来自潜在的冲突？假设我确保唯一发生（并且应该发生）的冲突是用户登录信息。
我的设置为所有站点共享 SECRET_KEY 和 SESSION_COOKIE_DOMAIN='.mydomain.com'。此设置是否存在严重的安全缺陷？
谢谢./w
I have built a Django site using the Sites Framework and have four sites on different subdomains. Lets call them one.mydomain.com; two.mydomain.com ... etc.
Three of the sites are product sites and one is a store. I want to be able to share sessions across the sites so a user doesn't have to login again when moving from any of the product sites to the store. I realize I could use cas to achieve the single login but I don't think that meets all my purposes.
I have read this post and this post on sharing sessions across subdomains and the consensus seems to be that it is a bad idea.
In my case I want a user to be able to add items to a cart on one subdomain and then proceed to the cart to checkout. I can't see a way of doing this without sharing sessions. A user should also be able to add to their cart from another product site and when checking out would see product from one.mydomain.com, product from two.mydomain.com etc.
So my question is why is sharing sessions a bad idea apart from potential conflicts? Assuming that i'm ensuring that the only conflicts that occur (and that should occur) is user login info.
My setup has the SECRET_KEY shared for all sites and SESSION_COOKIE_DOMAIN='.mydomain.com'. Is there a serious security flaw that I'm missing with this setup?
thanks ./w
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
在我看来，当您无法控制特定域的所有子域时，这是一个安全缺陷。例如，您有 one.mydomain.com 和 Two.mydomain.com，但浏览器也会将您的 cookie 提供给名为 bad.mydomain.com 的网站，因为您的设置为 SESSION_COOKIE_DOMAIN='.mydomain.com'。
如果您将开发环境保留为子域之一（例如 dev.mydomain.com），则会出现另一个潜在的漏洞。如果是这样的话，你就不会被孤立。
据我研究过这个主题，最坏的情况似乎是将您的 cookie 泄露给恶意子域，因此可能有人可以使用此 cookie 劫持真实会话。
目前我正在进一步研究如何以更好的方式隔离不同的子域（由同一个 Django 实例控制），但似乎除了重写 SessionMiddleware 之外没有真正的方法可以做到这一点。
It seems to me it's a security flaw in cases when you don't control all the subdomains of a specific domain. For instance, you have one.mydomain.com and two.mydomain.com, but the browser will give your cookie also to a website called bad.mydomain.com since your settings have SESSION_COOKIE_DOMAIN='.mydomain.com'.
Another potential hole would happen if you keep your development environment as one of the subdomains (eg. dev.mydomain.com). You wouldn't be isolated if that's the case.
As far as I've researched the subject, it seems that the worst case scenario would give out your cookies to rogue subdomains, so potentially someone could hijack a real session using this cookie.
At this moment I am doing further research how to isolate different subdomains (controled by the same instance of Django) in a better way, but it seems there's no real way of doing this except rewriting the SessionMiddleware.
从我读过的许多内容来看，这被认为是一个坏主意，如果您尝试在站点之间共享会话，似乎您可能会创建一些很难追踪的错误。据我所知，通常最好让事物尽可能无状态。
From many of the things I have read it is considered a bad idea, it seems like you may create some very hard to track down bugs if you try and share sessions between sites. As far as I know it is typically better to make things as stateless as possible.