The basic issue here is the way in which cookies work (which of course sessions depend on). A cookie has a domain attribute and browsers only send cookies whose domain match the request host (there's a little bit of subtlety of the meaning of a period at the start of the domain)
Furthermore, when setting a cookie, browsers will only accept a domain that is a parent domain of the current domain and which is not a public domain). For example if you are receiving a response from www.example.com
it can set cookies for www.example.com
or example.com
, but not .com
(Browsers have a list of which domain names shouldn't be allowed).
All this to say that if your two apps don't share a common parent (as it is in your case) then you can't share cookies and thus you can't share a rails session.
There are many ways to deal with this, a simple one is known as CAS (Central Authentication Service) protocol. The basic flow with this is
- User goes to hello.com and tries to access some protected resource (e.g. /home
- User is redirected to
sso.example.com/service?=http://hello.com/home
- The user's identity is verified here as usual: the user either logs in, is recognised from a cookie etc.
- The sso service generates a ticket (an arbitary token) and redirects the user to `http://hello.com/home?ticket=ABC123
- The application at hello.com makes a (server side) request back to the SSO server, passing the ticket
- The SSO server responds indicating whether the ticket is valid. If the ticket is valid it will also include some information about the user (e.g. email)
hello.com
sets a session cookie so that subsequent requests can skip steps 2-6
There are ruby implementations of cas (e.g. rubycas which has both a cas client and server) and devise strategies that use CAS. There are of course other ways you can do this, for example using oath, but CAS is somewhat simpler.