asp.net regarding cookie cross-domain issues-C#.Net Tutorial-php.cn

Home

Backend Development

C#.Net Tutorial

asp.net regarding cookie cross-domain issues

伊谢尔伦

Nov 25, 2016 am 09:19 AM

asp.netcookie

Cookies are a great invention that allow web developers to retain their users' logged-in status. But problems arise when your site has more than one domain name. According to the cookie specification, a cookie can only be used for one domain name and cannot be sent to other domain names. Therefore, if a cookie is set in the browser for one domain name, the cookie will not be valid for other domain names. If you want your users to log in from one of your sites and also log in from other domains, this can be a real problem.

Across second-level domain names

We know that cookies can be accessed across second-level domain names. This is easy to understand. For example, if you create a cookie in the web application of www.test1.com, you want to use it in bbs.test1.com To access such an application corresponding to a second-level domain name, you must set the domain parameter domain=test1.com when creating the cookie. Taking asp.net as an example, the code is as follows:

HttpCookie cookie = new HttpCookie("name", "www.Admin10000.com");
cookie.Domain = "test1.com";
cookie.Path = "/";
Response.Cookies.Add(cookie);

Cross top-level domain name

　If I am not a second-level domain name but completely in a different top-level domain name, for example, the web application where www.test1.com is located creates a cookie, and I want What should I do if I access www.test2.com or its second-level domain name application? We know that it cannot be accessed by conventional countermeasures. The key is to see if there is any way to access it. The fact is that cookies can cross domains under certain conditions, rather than achieving cross-domain at will.

Let’s do a test to see how the two sites www.test1.com and www.test2.com implement cookie cross-domain access. According to convention, we need to have 2 top-level domain names and a DNS server to configure the domain name, otherwise we cannot verify it, but we don't need to be so troublesome here. We can simulate it by modifying the hosts file. There is a hosts file in c:windowssystem32driversetc. Add the two lines

127.0.0.1    www.test1.com
127.0.0.1    www.test2.com

at the end, and you can use the above domain name to access the local loopback address. We only need to deploy a set of programs on IIS. The IP is the loopback address of the local machine and can be accessed using two domain names.

　 We create three new pages, namely Default.aspx, SSO.ashx, and GetCookie.aspx.

　 Among them, Default.aspx is the page of www.test1.com, and the accessed address is http://www.test1.com/Default.aspx. Take a look at the front-end code, it does not have any back-end code

<%@ Page Language="C#" AutoEventWireup="true" CodeBehind="Default.aspx.cs" Inherits="Admin10000.Web.Default" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
    <title></title>
</head>
<body>
    <form id="form1" runat="server">
    <div>
              <script type="text/javascript">
            var _frm = document.createElement("iframe");
            _frm.style.display = "none";
            _frm.src = "http://www.test2.com/SSO.ashx";
            document.body.appendChild(_frm);  
        </script>
       </div>
    </form>
</body>
</html>

The other one is the SSO.ashx page, we think it is the page of www.test2.com, the front-end does not have any code, the back-end code is as follows:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.Services;
using System.Web.SessionState;
 
namespace Admin10000.Web
{
    /// <summary>
    /// $codebehindclassname$ 的摘要说明
    /// </summary>
    [WebService(Namespace = "http://tempuri.org/")]
    [WebServiceBinding(ConformsTo = WsiProfiles.BasicProfile1_1)]
    public class SSO : IHttpHandler
    {
 
        public void ProcessRequest(HttpContext context)
        {
            HttpCookie cookie = new HttpCookie("name", "www.Admin10000.com");
            cookie.Domain = "test2.com";
            cookie.Path = "/";
            cookie.Expires = DateTime.Now.AddMinutes(10000);
            context.Response.Cookies.Add(cookie);
 
            context.Response.ContentType = "text/plain";
            context.Response.AddHeader("P3P", "CP=CAO PSA OUR");
            context.Response.Write("");
        }
 
        public bool IsReusable
        {
            get
            {
                return false;
            }
        }
    }
}

The last is GetCookie.aspx Page, it is also a page under www.test2.com, there is no front-end code, only back-end code:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
 
namespace Admin10000.Web
{
    public partial class GetCookie : System.Web.UI.Page
    {
        protected void Page_Load(object sender, EventArgs e)
        {
            if (Request.Cookies["name"] != null)
            {
                Response.Write(Request.Cookies["name"].Value);
            }
        }
    }
}

Okay, now we access the test by accessing http://www.test1.com/Default.aspx After that, the SSO.ashx page will be loaded through the iframe, the background code will be executed to create the cookie, and then we will visit http://www.test2.com/GetCookie.aspx and we will get the corresponding cookie. Note that cookies created under www.test1.com can be accessed under www.test2.com.

Things to note:

　admin10000.com Tips There is a sentence in the background code of SSO.ashx: context.Response.AddHeader("P3P", "CP=CAO PSA OUR"); is used to set the P3P response header. It is because the P3P supported by IE browser causes cookies to be blocked when iframe cross-site, and cookies cannot be created. (FireFox currently does not support P3P security features, and FireFox naturally does not have this problem. There is no need to add a P3P response header.)

Use the src attribute of the iframe to redirect the cookie value in the test1.com domain as the get parameter to test2. On the SSO.ashx page under the com domain, SSO.ashx obtains the cookie value passed from the test1.com domain and writes the obtained value into the cookie, thus simply realizing cross-domain cookie access.

　 In addition, the Default.aspx page can also be changed to JS calling form:

<%@ Page Language="C#" AutoEventWireup="true" CodeBehind="Default.aspx.cs" Inherits="Admin10000.Web.Default" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >
<head runat="server">
    <title></title>
</head>
<body>
    <form id="form1" runat="server">
    <div>
        <script type="text/javascript" src="http://www.test2.com/SSO.ashx"></script>
    </div>
    </form>
</body>
</html>

Statement

The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

修复：谷歌浏览器请求太多错误 429 [已解决]Apr 16, 2023 am 09:22 AM

近期很多Windows用户反映，当他们尝试访问某个URL时，PC上的GoogleChrome浏览器显示错误429。这是因为每次用户尝试在短时间内通过浏览器。通常，此错误是由网站生成的，以避免通过向服务器发送过多请求而被机器人或黑客入侵病毒。用户对在这个阶段可以做什么感到困惑，并因此感到失望。导致此错误的因素可能很多，我们在下面列出了其中一些因素。缓存内存和其他站点数据未清除从第三方来源安装的扩展系统上的一些有害软件病毒攻击在研究了上面列出的因素之后，我们在这篇文章中收集了一些修复程序，这

如果 Grammarly 无法在 Windows 10 浏览器上运行的 8 个重大修复May 05, 2023 pm 02:16 PM

如果您在Windows10或11PC上遇到语法问题，本文将帮助您解决此问题。Grammarly是最流行的打字助手之一，用于修复语法、拼写、清晰度等。它已经成为写作专业人士必不可少的一部分。但是，如果它不能正常工作，它可能是一个非常令人沮丧的体验。许多Windows用户报告说此工具在他们的计算机上运行不佳。我们做了深入的分析，找到了这个问题的原因和解决方案。为什么Grammarly无法在我的PC上运行？由于几个常见原因，PC上的Grammarly可能无法正常工作。它包括以下内

如何修复 Google Chrome 上的 Roblox 403 禁止错误May 19, 2023 pm 01:49 PM

许多Windows用户最近在尝试访问GoogleChrome浏览器中的网站URL时遇到了一个不寻常的错误，称为Roblox403禁止错误。即使在多次重新启动Chrome应用程序后，他们也无能为力。此错误可能有几个潜在原因，我们在下面概述并列出了其中一些。Chrome的浏览历史和其他缓存以及损坏的数据不稳定的互联网连接网站网址不正确从第三方来源安装的扩展在考虑了上述所有方面之后，我们提出了一些修复程序，可以帮助用户解决此问题。如果您遇到同样的问题，请查看本文中的解决方案。修复1

vue3中cookie如何使用May 12, 2023 pm 02:19 PM

前言cookie使用最多的地方想必是保存用户的账号与密码，可以避免用户每次登录时都要重新输入1.vue中cookie的安装在终端中输入命令npminstallvue-cookies--save，即可安装cookies，安装之后在main.js文件中写下以下代码import{createApp}from'vue'importVueCookiesfrom'vue-cookies'constapp=createApp(App)app.co

如何在 Google Chrome 中启用或禁用第三方 CookieApr 15, 2023 pm 02:07 PM

每个网站都通过创建cookie使用户更容易浏览他们的网页和浏览他们的网站。然而，网站创建了一些第三方cookie，使他们能够跟踪访问其他网站的用户，以便更好地了解他们，从而有助于展示广告和其他帖子。一些用户可能认为他们的数据遭到破坏或存在安全风险，而另一些用户可能认为允许这些第三方cookie跟踪他们以在浏览器上获取更多内容是很好的。所以我们在这篇文章中解释了如何在谷歌浏览器中启用或禁用第三方cookies，详细步骤如下。如何在GoogleChrome中启用第三方Cookie如果您认为要

PHP8.0中的Cookie库May 14, 2023 pm 04:51 PM

在互联网应用开发中，使用Cookie是常见的一种方式来维护用户会话状态。在PHP语言中，处理Cookie的相关功能在语言的核心库中得到了完善的支持，在最新的PHP8.0版本中，Cookie库得到了进一步的增强。一、PHP中的CookieCookie是一个小文本文件，可以存储在用户的浏览器中，它通常被用来记录用户的个性化设置、登录状态等信息。Cookie是基

php curl怎么设置cookieSep 26, 2021 am 09:27 AM

php curl设置cookie的方法：1、创建PHP示例文件；2、通过“curl_setopt”函数设置cURL传输选项；3、在CURL中传递cookie即可。

如何在ThinkPHP6中使用Cookie技术实现记住我功能Jun 20, 2023 pm 03:33 PM

随着互联网技术的不断发展，越来越多的网站需要用户登录才能使用其功能。但是每次用户访问时都需要输入账号密码显然很不方便，因此“记住我”的功能应运而生。本文将介绍如何在ThinkPHP6中采用Cookie技术实现记住我功能。一、Cookie简介Cookie是一种服务器向客户端发送的小文件，在用户访问网站时存储在用户的计算机上。这些文件包含与用户相关的信息，如登录

See all articles