I have a multi-site Magento (A PHP eCommerce platform). Accounts are shared across sites, but sessions are not, so you have to log in to each site individually. I'm interested in sharing these sessions.
I found an answer on the Magento stack exchange. Sharing Sessions Between Stores with Different Domains. The recommendation is this:
setcookie("frontend", htmlspecialchars($_GET['SID']), time() + 86400);
<?php $sessionId = Mage::getSingleton('core/session', array('name' => 'frontend'))->getSessionId(); ?> <img src="https://example2.com/cookie.php?SID=<?php echo $sessionId; ?>" style="display:none;" />
I'm trying to wrap my head around the full security implications of this. If I'm not mistaken, this URL becomes all that is needed to log in as a user.
All of our sites are HTTPS only, so I think that helps prevent anyone listening in on traffic from getting this URL, correct?
One issue I might see is that if someone is at the physical computer, they would have access to that URL and could use it to login from a different computer, which would otherwise be impossible without the password. Expiring the session prevents against that though, right? If so, sessions are currently pretty long so carts stay alive longer, so how short should the sessions be?
In short, Is this an insecure implementation of multi-site login sessions? If so, can this approach be made secure?