Home/ Questions/Q 6170909
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-23T23:07:18+00:00

I’ve got the following setup: Site1 (Core) at Core.example.com Site2 (Work1) at Work1.example.com Site3

  • 0

I’ve got the following setup:

Site1 (Core) at Core.example.com
Site2 (Work1) at Work1.example.com
Site3 (Work2) at Work2.example.com

etc… I’ll just user Work1 in discussion but the problem applies to all the Work sites

The idea is that Core is used for logins, payments, account management, etc and the Work sites offer functionality which is sufficiently different to justify separate CI instances/Dbs/etc.

This works relativfely well in that Core can set cookies which are picked up by the other sites.

The issue I’ve got is that I want to allow eg Work1 to make calls to Core on behalf of the user/as the user – for things like updating user account details, getting a list of services available to the user, etc.

I’m currently trying to do this via CURL. If I read the Core session cookie in the HTTP request made by the client to Work1 and inject it into the CURL request from Work1 to Core, Core doesn’t accept it as a valid session cookie. I’m not sure if this is due to differing IP addresses (Client vs Work1) or something else.

Unfortunately, I need Work1 to have its own database so sharing a DB is not a viable option. That said, I’ve used the same encryption key across the sites so can decrypt/parse cookies (or anything else) as required on any site.

Can someone please suggest how I can convince Core that a request from Worker1 with the users’ Core session cookie is in fact from the user?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I was eventually able to work around this by reading to cookie and injecting it into curl requests. I also had to handle session cookie updates retrieved via CURL, re-wrap them and pass them back to the client.

    I also extended the IP verification to check the the session IP is Either: the client IP for the current request OR is my Work1 site’s IP address and the HTTPS request has a MySite-OriginalIp header (which is attached to all my CURL requests) and that this value matches the session.

    There are a number of other security enhancements, tweaks and sanity checks that are required to get this going in a robust and reliable way without compromising security – Too many to detail here.

    • 0