Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Can I share user session or cookie between two entirely different websites. I have two websites www.xxx.com and www.yyy.com(different wp installation). While logged user clicks on a link page from website1 could be redirect to website2 post details page. So user should post a comment as user.

Is this possible in entirely two different hosted websites ? (Most Preferred)

(or)

Should I do any modification like multi-site or sub domain installation.

Please suggest me your ideas on this feature.

share|improve this question
    
I use a wp-config option to share users database between two installation, but I use the same database with different prefix. Also, it's the same user but user need to log in twice (with the same credentials) when swapping. So I don't know if it could of some interest. –  Simon Feb 15 '13 at 14:30

1 Answer 1

The short answer: There is no way to share cookie/session info between different domains (this also includes subdomains).

The long answer is, that in your special situation it is possible to build such a construct between to wordpress installs, but this will need some modifications and might impose some security concerns. As this is somehow a more complex task and there are no plugins or tutorials available I could link to, I will just write down how I would approach this task myself.

You would basicly just need to get two parts to get this working: - find a way to sync the user database, or to access the user database of the other install (you could do this the way Simon suggested). - for every logged in user add a parameter to the URLs on your page that are leading to the second installation that includes the information which user needs to be logged in, fetch this parameter in installation two and login the user.

To add some security to the whole thing you shouldn't just build a link like http://www.yyy.com/?uid=4 as everyone who knows this url could easily log in to your wordpress install without any password. I would start with building a 'session-id' and store this together with a timeout value which is refreshed on every pageload in the user_meta of the shared/synced user database and then hash this with userid + password + ip + a fixed SALT key shared by both installs. Then you will end up with an more secure version of the url like http://www.yyy.com/?uid=d41d8cd98f00b204e9800998ecf8427e.

This is still no 100% perfect secure method (as there is no way to achieve this in this constellation), but as long as your users are only allowed to post comments (and login via this remote methode is disabled for admins!) I would personally say the risks are acceptable and I guess it could be done in 50 to 100 lines of code in wordpress.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.