Using gae-sessions between domains

Question

I'm using gae-sessions library for session management in my GAE app. I want to this app to be a registration and login center for several other GAE apps. I mean when user enters one of the others app (let's say "client app" - this app also is using gae-sessions), and want to log in, its credentials are submitted to the "center app", there login and password are verified and user is redirected back to the "client app". Is it possible for "center app" to create a session (using gae-session) with logged in user data (if login and password were correct) and for "client app" to somehow access data from this session, when user is redirected back from "center" to "client".

Answer 1

You could do this if your apps are subdomains of a particular domain:

1. Add the Domain key to COOKIE_FMT (in gae-sessions source file) to indicate that the cookie from the "central app" should be sent to all subdomains (if your domain was xyz.com then you would want the cookie's domain value to be set to .xyz.com to have the cookie sent with requests to all subdomains).

2. Use cookie-only sessions (the default for sessions under about 10kB of data) and the same value for the COOKIE_KEY configuration parameter for each of your apps.

A cross-domain solution would require a little more work and custom code. There are some questions on this site which address cross-domain cookie solutions (eg, What's your favorite cross domain cookie sharing approach? ).