0

I'm setting up a site whose entire purpose is essentially a landing page. This page will create a cookie when the user fills out the proper form. To handle cookies I'm using this jquery plugin.

My problem is, I have a separate site that should only be able to be viewed if the user has the cookie from the first site (the landing page). So far, in my testing, I have been having trouble since the cookie that I set at my landing page doesn't appear on the other site. The landing page is being tested on localhost, but the site that requires the user to have the cookie before viewing is live on the internet.

Here is how I set the cookie:

$('#submit')[0].addEventListener("click", $.cookie("test-cookie", "test-value"));

Then, at the other site I have something like this to check the cookie:

var cookie = $.cookie("test-cookie");
if (cookie != null && cookie != "") {
    console.log("TRUE");
} else {
    window.location = "http://www.thelandingpagesite.com";
}

Now, I'm not sure if the problem is with cookies (I don't know if they can be so easily transfered between sites, as far as I am aware of, they exist on the Users computer), or if I'm just setting it up wrong. Any help would be greatly appreciated! Thanks.

2

4 Answers 4

1

As far as I am aware, one site (www.example.com) cannot retrieve cookies from a browser for another site (www.Second-example.com).

It would be a major security breach if this was allowed as it would be very easy for someone to steal your cookie and gain access to your accounts and personal details.

I am afraid you are going to have to use some mechanism other than cookies.

You could store their IP as you suggest in a a comment on another answer. Just be aware that anyone on that Lan could access the page... for example if a student in a school fills out your form... the whole school would have access to the page you are trying to restrict.

1

Cookies are stored by the user's browser, but they are stored with a reference to the site that set them.

Site A cannot set a cookie for Site B.

Cookies are used to (among other things) store preferences. Allowing any arbitrary site to set a user's preferences for any other arbitrary site would invite vandalism.

3
  • thanks for your quick reply! so then how would I go about making the second page viewable to only those users who have filled out a form on the first site? Should I just store the IP and and somehow check for that on the second site?
    – atb
    Aug 13, 2012 at 20:05
  • Not can site B read a cookie for site A, otherwise nastygansters.ru would be poking at yourbankaccount.com.
    – Marc B
    Aug 13, 2012 at 20:05
  • @alexthebake — Generate a one time token, send it to site B, then redirect the user to site B with that token in the query string, have site B recognise the token, mark it (in its database) as used and set the cookie, then redirect to the content.
    – Quentin
    Aug 13, 2012 at 20:08
0

Cookies are set for a specific domain or set of subdomains. They can be readable across multiple subdomains, so it would be possible to set a cookie for domain '.domain.com' that would be sent along with all requests to 'www.domain.com', 'landingpage.domain.com', etc.

If ultimately you would be having your landing page and the page they are be sent to on the same root domain, this would be possible.

0

It doesn't seem like authenticating a user is an issue with your question, you merely want the user to visit Site A before they can visit Site B.

This question might be of some use: Cross domain iframe content load detection

On Site B you could have an Iframe pointing to a page on Site A which in turn loads an Iframe pointing to a page on Site B. If the Iframe pointing to Site A doesn't have the cookie, it could pass that information to the Iframe of Site B (by loading a different page perhaps), which when loaded could then call parent.parent.cookieNotSet() (or whatever you decide to call that function) so that Site B would redirect to Site A.

I hope that makes sense. It's a big workaround, but required to get around cross-domain issues. All of this would obviously require that JavaScript is enabled on the browser but what browser doesn't have JavaScript enabled nowadays?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.