how to handle login between different domains?

Question

I've a website with 2 domains (.nl and .com) and a translated version of the content is displayed depending on the domain.

My issue is that when a client login under a .nl domain, and he moves to the .com domain, he is not anymore logged in.

thanks

Answer 1

This is essentially the same problem StackExchange had with 'global network auto-login'.

Here is what Jeff wrote on the blog about their implementation:

While subdomains such as chat.serverfault and meta.serverfault are easy if you store your cookies the right way, getting access to cookies at different domains is, to put it charitably, a friggin’ nightmare. The whole third party cookie story — that is, reading or writing cookies stored at a domain other than the one you’re currently on — is irreversibly screwed up, and getting worse with every new browser release, thanks mostly to unscrupulous ad networks.

So, we gave up on using third-party cookies. Instead, we use HTML 5 Local Storage for global authentication, at our centralized domain stackauth.com. Now, this does require a modern browser, though not unreasonably so: IE8+, Chrome, Safari, FireFox 3.6+, and Opera 10.61+ are all supported.

I'm assuming that the user is accessing your site via HTTP. If it is via HTTPS, you are out of luck, the user will have to log in again.

Overall however, I would urge you to design the site in such a manner that the user never has to move between top level domains. You could for instance replicate example.nl on nl.example.com and rely on the latter if the user is already logged in on example.com (and vica versa).

For SEO purposes you would probably want to disallow all crawling of nl.example.com