New answers tagged session-management
Fundamental to anything, the use of a token/coookie is the authentication mechanism's reason it works. How this cookie is verified by a third party is the magic sauce. It's surprisingly funny how everyone keeps trying to break web 1.0s client/server model to include 3rd party intervention.
Secure session details per-website are stored in local cookies set by a response and sent to the server in future requests. For cross-domain example, like you described with youtube (and a comment described), the standard method is OAUTH or OAUTH2. It is the same mechanism that you may allow other websites to access your facebook or twitter details. This ...
I am considering always passing ?PHPSESSID=x in the query string for each relevant url as a workaround. This is not the best practice, but if you decide to choose this method (because it is easy), you can make something like this: <?php define("COOKIE_NAME", "PHPSESSID"); define("DOMAIN", "example.com"); function ...
It's bad practice. Whenever you can, reuse what already exist instead of creating your own. Session management is pretty common and just work. Since the usual session cookie will most likely be blocked as a third party cookie I am trying to find a suitable way to do this. No, the cookie will not be blocked in your iframe. Cookie are set browser wide ...
Top 50 recent answers are included