3

I am developing a nop commerce store (3.50) . I have a requirement that user will be redirected to nop commerce site when he clicks on the link provided on my informative website. I want to pass the loegged in user information from that site to nop commerce store so user don't need to log in on nop store again.

Is it possible to pass the username and password as header values when user is redirected to nop store and i can programmatically set user as logged in using those credentials from header ?

Sachin Trivedi
  • 2,033
  • 4
  • 28
  • 57

1 Answers1

1

This actually is possible to do, though it requires some modification of the stock NopCommerce code. Since Nop.Commerce uses cookies, what you'll have to do is validate the user via AJAX,return a disposable token, and do some redirects.

Here is what I did:

1) Modify the target server to allow cross-origin requests.

2) Create a custom ActionResult in the CustomerController on the target server that verifies the user's identity via AJAX. If it's a SUCCESS, set a custom customer attribute (how you do it is how you see fit) with a one-time use security token. Return a JSON object that is SUCCESS/FAILURE back to the client. Do NOT! log the user in at this step

3) Make another custom ActionResult in the CustomerController, that passes in the user's e-mail address in the security token. If the security token matches the custom customer attribute (set in step 2), you'd want to log the user in at this junction and set a session cookie in this ActionResult. Load a black page that has JavaScript unction to redirect the user to the customer post-sign in landing page (to make sure the cookie got set to the client's machine). THIS IS CRITICAL, MAKING SURE A PAGE LOADS AFTER SETTING THE COOKIE BEFORE REDIRECTING TO AN AUTHORIZED PART OF THE SITE.

4) Make an external login page on your remote site, where you use an AJAX call to verify the user's identity to the ActionResult created in step 2.

5) When the client gets the JSON object, if it's valid login, redirect them to the ActionResult created in step 3.

The big thing is with forms authentication, is that you MUST make the user visit a page on the targeted domain before the cookie is set. Doing EXTERNAL_SITE -> TARGETSITE_AUTHENTICATED_PAGE does not work. You must do EXTERNAL_SITE -> TARGETSITE_SETCOOKIE_AND_REDIRECT_PAGE -> TARGETSITE_AUTNETICATED_PAGE

Jeffrey Kern
  • 2,024
  • 20
  • 40