2

I would like to set a specific cookie domain for my cookies, because this might solve some issues our site seems to have with IE8. Django seems to have a setting called SESSION_COOKIE_DOMAIN which can be set to obtain this. The problem however is that our site contains multiple subsites which have alternative domain names. So my question is, how can I manage this? I would like to have a standard cookie domain per domain, because I fear browsers like IE8 will reject cookies which aren't from the same domain (quicker).

I will do research myself, but I wondered if anyone perhaps has experience.

Update:

What I actually want to do is to make django store cookies for domain1 when I visit domain1.com etcetera for the other domains. I think it should be as easy as to use the current client domain when storing cookies. I doubt however that django offers such functionality without modification... Maybe I could build a middleware class that changes the global setting to the current domain..

Update:

This question and answer helped me out: Changing Django settings variable dynamically based on request for multiple site Thanks for help :)

Community
  • 1
  • 1
Lucas Moeskops
  • 5,445
  • 3
  • 28
  • 42

1 Answers1

6

Cookies can't be stored or retrieved for other domain names. In other words, if I am at yahoo.com I can't get the cookie for google.com. However, foo.yahoo.com and bar.yahoo.com can both retrieve cookies saved at .yahoo.com.

If you are running a website with multiple subsites, if they all share the same basic domain (i.e. site1.domain.com, site2.domain.com, etc) you should use that domain for SESSION_COOKIE_DOMAIN. But if they have different domains, it's basically impossible for them to share cookies without using some other method of getting the cookies. You can, for example, include images or scripts that point to a central site, and that site can store and retrieve the cookies, which are made available to the rest of the page via JavaScript.

If you must keep these alternate domain names, you can always set your web server to redirect immediately from these alternate domain names to the shared standard domain. This is easy to do with mod_rewrite.

Jordan Reiter
  • 20,467
  • 11
  • 95
  • 161