获取cookie时如何重定向页面两次

Question

Firstly, I know this nearly impossible because someone can steal cookie if this possible.首先，我知道这几乎是不可能的，因为如果可能的话，有人可以窃取 cookie。 But because I am still doubtful around 1%, so I think I need to ask the community, so I can completely know if this still possible or completely impossible.但是因为我仍然怀疑 1% 左右，所以我认为我需要询问社区，这样我才能完全知道这是否仍然可能或完全不可能。

Let's say I have mysite.com/promotion which is permalink for shop.org/aff.php?id=123 .假设我有mysite.com/promotion ，它是shop.org/aff.php?id=123永久链接。 Id 123 is my affiliate ID. ID 123是我的会员 ID。 After visitor click that link, the visitor will redirected to shop.com/index.php (homepage).访问者单击该链接后，访问者将重定向到 shop.com/index.php（主页）。 Then shop.com will command the visitor browser to save my affiliate cookie.然后 shop.com 将命令访问者浏览器保存我的附属 cookie。 Note : I have access for mysite.org but I don't have any access for shop.com.注意：我可以访问 mysite.org，但没有任何访问 shop.com 的权限。

The problem with this behaviour is that I only can promote the overall whole things about shop.org, but I cannot promote his specific product link .这种行为的问题在于，我只能推广有关 shop.org 的整体内容，但我无法推广他的特定产品链接。 Because when I give the visitor a product link, I will not have any commission because the guest never access my affiliate url.因为当我给访客一个产品链接时，我不会有任何佣金，因为访客永远不会访问我的会员网址。 But when I give him my affiliate url, he will need to find out where the product link is.但是当我给他我的附属网址时，他需要找出产品链接的位置。

Now I will give some demo code to illustrate this.现在我将给出一些演示代码来说明这一点。

shop.org/index.php shop.org/index.php

<?php session_start()?>
<h1>shop.com HOME PAGE</h1>
    <div>cookie affiliate: <span>EMPTY</span></div><br>
<script src="https://cdnjs.cloudflare.com/ajax/libs/js-cookie/2.2.1/js.cookie.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js"  ></script>
<script type="text/javascript">
    $(function(){
        <?php if(isset($_SESSION['aff'])):?>
        Cookies.set('aff', '<?=$_SESSION['aff']?>');
        <?php endif;?>
        var aff = Cookies.get('aff');
        if(aff!==undefined){
            $('span').text(aff);
        }
        
    })
</script>

shop.org/aff.php?id=123 shop.org/aff.php?id=123

<?php session_start();
$_SESSION['aff'] = $_GET['id'];
header('Location:https://shop.org/index.php');

shop.org/product.php shop.org/product.php

<?php session_start();?>
<p>shop.com PRODUCT PAGE</div>
<div>cookie affiliate: <span>EMPTY</span></div><br>
<script src="https://cdnjs.cloudflare.com/ajax/libs/js-cookie/2.2.1/js.cookie.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js"  ></script>
<script type="text/javascript">
    $(function(){
        <?php if(isset($_SESSION['aff'])):?>
        Cookies.set('aff', '<?=$_SESSION['aff']?>');
        <?php endif;?>
        var aff = Cookies.get('aff');
        if(aff!==undefined){
            $('span').text(aff);
        }
        
    })
</script>

Try 1: hidden iframe then redirect with js / html meta尝试 1：隐藏 iframe 然后使用 js / html meta 重定向

mysite.org/promotion mysite.org/promotion

<!DOCTYPE html>
<html>
<head>
    <title>INI REDIRECT</title>
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
    <meta http-equiv="refresh" content="5;URL=https://shop.org/product.php" />
</head>
<body>
    <iframe src="https://shop.org/aff.php?id=123" width="0" height="0" tabindex="-1" title="empty" style="display:none;"></iframe>
    <div>You will be redirect in 5 seconds</div>
</body>
</html>

Visitor will fail to get my affiliate cookie because he get warned : A cookie associated with a cross-site resource at https://shop.org/ was set without the 'SameSite' attribute. It has been blocked, as Chrome now only delivers cookies with cross-site requests if they are set with 'SameSite=None' and 'Secure'.访问者将无法获取我的附属 cookie，因为他收到警告： A cookie associated with a cross-site resource at https://shop.org/ was set without the 'SameSite' attribute. It has been blocked, as Chrome now only delivers cookies with cross-site requests if they are set with 'SameSite=None' and 'Secure'. A cookie associated with a cross-site resource at https://shop.org/ was set without the 'SameSite' attribute. It has been blocked, as Chrome now only delivers cookies with cross-site requests if they are set with 'SameSite=None' and 'Secure'.

Try 2: jQuery load尝试 2：jQuery 加载

<!DOCTYPE html>
<html>
<head>
    <title>INI REDIRECT</title>
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
    <meta http-equiv="refresh" content="5;URL=https://shop.org/product.php" />
</head>
<body>
    <iframe src="https://shop.org/aff.php?id=123" width="0" height="0" tabindex="-1" title="empty" style="display:none;"></iframe>
    <div>You will be redirect in 5 seconds</div>
    <div id="msgDiv"></div>
    <script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js"  ></script>
    <script>
        $(function(){
             $('#msgDiv').load('https://shop.org/aff.php?id=123');
         });
    </script>
</body>
</html>

this will fail too, because CORS policy.这也会失败，因为 CORS 政策。 Remember I don't have any access to shop.org, so I can't enable this.请记住，我没有任何访问 shop.org 的权限，因此我无法启用此功能。

Try 3: scraping the cookies then give visitor that cookies尝试 3：抓取 cookie 然后给访问者那个 cookie

I have not given code here, because I know this will fail too.我没有在这里给出代码，因为我知道这也会失败。 The reason is we cannot give cross domain cookie to the browser.原因是我们不能向浏览器提供跨域 cookie。

My question is, is this completely impossible or still possible?我的问题是，这是完全不可能的还是仍然可能的？

Note : if only 1 site, I just need to email them to fulfill my needs.注意：如果只有 1 个站点，我只需要给他们发送电子邮件即可满足我的需求。 But, shop.org is only 1 example of the most common affiliate system.但是，shop.org 只是最常见的联盟系统的一个例子。 So this question is only focusing without any change at server.所以这个问题只关注服务器，没有任何变化。 Yes, impossible, but I just have a little doubt here.是的，不可能，但我在这里有点怀疑。

Answer 1

I think it's nearly impossible, because the CORS-Policy is exactly to block this cases.我认为这几乎是不可能的，因为 CORS-Policy 正是为了阻止这种情况。 You can do something like this only if the other site allows this with a specific HTTP-Header.只有当其他站点允许使用特定的 HTTP-Header 时，您才能执行类似的操作。

You can try <img src="https://shop.org/aff.php?id=123" style="height: 0; width: 0;"> , but i think the result would be the same to the iframe.您可以尝试<img src="https://shop.org/aff.php?id=123" style="height: 0; width: 0;"> ，但我认为结果与 iframe 相同.

Other method:其他方法：

Maybe the shop-page offers this method, for example with a GET-Attribute:也许商店页面提供了这种方法，例如使用 GET-Attribute：

shop.com/aff.php?id=123&url=/product/myproduct/ shop.com/aff.php?id=123&url=/product/myproduct/

or或者

shop.com/product/myproduct/?aff=123 shop.com/product/myproduct/?aff=123

获取cookie时如何重定向页面两次

问题描述

1 个解决方案

解决方案1
0 2020-10-10 21:09:44

获取cookie时如何重定向页面两次

问题描述

1 个解决方案

解决方案1 0 2020-10-10 21:09:44

解决方案1
0 2020-10-10 21:09:44