How to solve cross-origin Cookie and Session access using Iframe _ PHP Tutorial

Solutions for how to use Iframe to access cookies and sessions across domains. Recently integrated the login system, one of the most critical problems encountered is that access to another system backend must be accessible in a unified background, this system is provided by a third party for the recent integration of login systems. one of the most critical problems encountered is that access to another system backend must be accessible in a unified background, this system is provided by a third party, and the background automatic logon interface is analyzed by itself. it is not provided separately. when you log on from the unified background through the automatic logon interface, the system directly jumps to the homepage of the system background. the URL to jump to after the background logon is successful cannot be specified here, and the page to jump cannot be controlled. if you need to link to another page in the background of the system, instead of the default homepage in the background, the menu function of the third-party system is put in our unified background.

For such a requirement, you may encounter a problem here. to properly access the background columns of a third-party system, you must ensure that you have logged on to the system. Otherwise, you will be prompted to log on, therefore, when you click these menu links, the system must have logged on.

To solve this problem, an invisible iframe is added to the header of the page to direct it to the automatic logon interface. if this interface is normally accessed through the browser address bar, when the user name and password are verified correctly, the system will jump to the background homepage, because it is placed in an invisible IFRAME, so the jump has no impact on the current background page. According to my design method, the system should be ready for normal use.

However, when we talk about it, it means we must have encountered a problem. Otherwise, we will not make such a big turning point here.

However, because each system belongs to a different system and the domain name is different, Iframe in IE cannot generate a third-party system Cookie normally, but it can be generated in Firefox and other browsers. Therefore, when you use IE to access, you will always jump to the logon page.

It should be noted that the third-party systems here are placed on our own servers, but all source code is encrypted!

Finally, I checked the relevant information and found that in IE, to ensure security, I blocked the use of IFRAME to generate a third-party domain COOKIE. to solve this problem, MS requires that as long as the HTTP HEADER is in, set the P3P header to generate a third-party COOKIE through IFRAME.

In PHP, the P3P HEADER is set as follows:

Header ('p3p: CP = "CURa ADMa DEVa PSAo PSDo our bus uni pur int dem sta pre com nav otc noi dsp cor "');

Note: The P3P must be added to the file where the Cookie is generated in the third domain. Otherwise, it will not help.

There is another problem here. a third-party system generates a COOKIE called admin in the background. the php page is generated, and the page is encrypted. what should I do? after thinking for a long time, my colleagues finally had a chance to get started, we can use our own file to include it. This is a wonderful method. Why can't I think of it? my colleagues are really talented. I really admire him. of course, I admire him so much, he admired himself for one night.

So the final solution is to change the original admin. name the php file admin_2.php and create a new admin. php, add the above P3P HEADER in this file, and again include the admin_2.php file. the final code is as follows:

Header ('p3p: CP = "CURa ADMa DEVa PSAo PSDo our bus uni pur int dem sta pre com nav otc noi dsp cor "');
Include "admin_2.php ";

Finally, the problem is completely solved!

The title here is about COOKIE and SESSION. in essence, it is basically the same thing. the final storage of SEESION is also saved to the COOKIE source code Sky through SESSION_ID, then, use this SID to find the corresponding SEESION data on the server. if you delete the SEESION_ID COOKIE in the COOKIE, the SESSION will become invalid.

...