Home/ Questions/Q 7969161
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-04T07:11:36+00:00

I am trying to implement SSO with a vendor, and they require I send

  • 0

I am trying to implement SSO with a vendor, and they require I send a HTTP request. In this HTTP request, there is a custom header for username and password, which is where I pass in the u/p info. If the user is authenticated, then they send back an ‘auth cookie’. I’m trying to understand a few things:

  1. What exactly is this auth cookie? Is this a standard thing? or all it means is that its a cookie that has authentication information?

  2. The HTTP request is sent to a domain which is different than mine. i.e., the script that sends the request is on a.com and the URL where I need to send the HTTP request is b.com. The vendor is saying that I am supposed to just ‘send’ the cookie they return in the response back to the user. This is not working, but I need to understand why – what will the domain of the cookie be? Will it be a.com or b.com? If its b.com, will that work, because the script that is actually making the call will be in a.com, and most browsers don’t allow third-party domain cookie. Or is it failing because I am trying to write a cookie with a.com, where the cookie already has data for b.com?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Figured this out. The HTTP returned is just another custom header value, and not a cookie. So, we have to write our own cookie. However, obviously, the other domain doesn’t recognise the cookie. So we actually build a reverse proxy in IIS, so that the domain a.com accesses the site through the proxy, called x.a.com, and never see b.com. So the cookie written is recognized by that domain.

    • 0