PHP sessions across 2 subdomains

For this answer, I made several assumptions:

• User must enter credentials at least once in each domain (any other method would be a serious security issue).
• You have access to a database or file space outside of your web root.
• subdomain, domain or any other name will be called "site"
• The goal is to have a common file (physical file or serialized in a database) accessible from every site / domain.

In my example, I will be using a database, since this is the idea I am using, not the database / file access methods, I will have unnecessary rows deleted. IE: How to connect to the database.


If this concept is what you were, or if anyone else wants me to fill in the blanks for completeness, just leave a comment. With code.




I would take a completely different approach.
From what I am gathering from your question and the associated post you linked to, you are trying to share a session using the common session name.

• Each site has its own session ID.
• Each site has its own cookie authenticator ($ _COOKIE ['userid'] or $ _COOKIE ['userhash']).
• Separate sessions are created and a shared cookie is stored on each site.
• • Using its own session handler, each site reads the same data. class MySessionHandler implements SessionHandlerInterface
    
    
  • My after thought was an even simpler approach, a class that acts as a session handler, read / write to a shared file. As the php session handler does not save data until the script ends.
    
    

Original idea - won't go into details, this is just for reference.

class MySessionHandler implements SessionHandlerInterface {
    private $savePath;

    public function read($id) {
        $id   = some_user_authentication_function();
        $hash = $_COOKIE['_h'];

        $result = mysql_query("SELECT sess_data FROM login_table WHERE user_id = {$id} AND hash = {$hash}");
        return $result['sess_data'];
    }

    public function write($id, $data) {
        $id   = some_user_authentication_function();
        $hash = $_COOKIE['_h'];

        $result = mysql_query("UPDATE login_table SET sess_data = {$data} WHERE user_id = {$id} AND hash = {$hash}");

        return ($result === false) ? false : true;
    }
}

$handler = new MySessionHandler();
session_set_save_handler($handler, true);
session_start();

      

        
        
        
      

    

class customSessionHandler
{
    private $hash;
    private $id;
    private $sess_db;

    public function __construct($db) {
        $this->hash    = $_COOKIE['hash'];
        $this->id      = some_user_authentication_function($this->hash);
        $this->sess_db = $db;
    }

    public function get($key) {
        $query = 
            "SELECT value ".
            "FROM ".$this->sess_db.
            "WHERE user_id = {$id} ".
            "    AND hash = {$hash} ".
            "    AND key = {$key}";

        $result = mysql_query($query);
        return $result['key'];
    }

    public function set($key, $val) {
        $query = 
            "REPLACE INTO ".$this->sess_db.
            "SET {$key} = {$val} ".
            "WHERE user_id = {$id} ".
            "    AND hash = {$hash}";

        return (mysql_query($query) === false) ? false : true;
    }
}
$handler = new customSessionHandler('sess_data');
session_start();

      

        
        
        
      

    

As stated at the beginning, any code that is not essential to explain the concept has been removed.
Things that may not be obvious to everyone: - $ key and $ val need to be sanitized before being sent to the database. (prevent injection) - The hash is sent to your login functions, so the hash can be used to clean up the session data when needed, can also be used when authenticating the user. - Ready-made mysql statements would be ideal here, so you can prepare two queries in the constructor and then just reuse the statement for each call. Then put the code for closing the connection in the destructor.

After the thought


It would be a lot more secure if every site had its own hash.
Then, if you find a security anomaly, you can simply block or re-request credentials from one site without compromising the hash for the site network.


To implement this would be as simple as creating another table containing: - User ID - site_name (example.com) - Hash - Timeout - Re-authenticate

and by modifying the session_data table, so instead of accessing the $ key => $ val pair with a hash, you access it user_id.




Thanks for reading, I hope it will be helpful to someone.