Using a “cross-domain” to front a login for another domain

Question

I want to use the domain: aaaa.com to have a login form for the site at domain: cccc.com.

Note, I have full control of the server at cccc.com and have setup CORS on the server at cccc.com. I essentially have full control of the server at aaaa.com as well.

I am using jquery's $.ajax to send a POST to the cccc.com asp.net mvc 3 server. It looks like I get the right response back and I see the ASP.NET_SessionId and .ASPXAUTH cookies in the response. When I get the correct response in javascript with no login errors, I want to redirect to cccc.com/Home/Index using window.location. Everything seems to be working up to this point. Authentication, getting a correct response, etc. However when javascript redirects, cccc.com still wants me to login again. Why is this happening?

Is it because the authentication cookies belong to aaa.com? How can I work around this?

Thanks

Answer 1

Yes, the authentication cookies will belong to the other site, and are not shared.

If you had a subdomain of cccc.com instead of a completely separate domain, it would work if you set a domain-wide cookie.

As it is though, you will have to copy the cookie upon login, logout, and any other authentication methods that modify how the cookie is stored. If you're on a different server, you would also lose your ability to do sessions unless you have a session state server.

You could try copying the auth cookies with javascript after your POST to log in completes.