using session data across applications and subdomains

[Beals]

Is there a way to share session <b>data</b> across different CF applications? across different subdomains?

The goal here is single source login that stores complex data in a re-useable session scope. The current installation uses wddx to serialize the data and drop it into a cookie. I am looking for alternatives to the WDDX method as it has been causing a number of errors.

For example I have application "a" at appA.domain.com ~ a user logs in an a session is created [domain cookies are set].

I would like the user to be able to go to both appA.domain.com/subapp [which has its own application.cfm] and reuse the session created at appA.domain.com.

Similarly I would like the session created appA.domain.com to carry over to appB.domain.com [which would has its own application.cfm file].

Thanks for any help.
~jason.

[SafariTECH]

That would be known as cros-site scripting and most browsers disable that now, as it is a security issue if an application can read cookies from a different site domain.

Sites that use cross-site data have to either pass it at the time accessig the other domain (via URL) or use a single database to record and recall data between applications.

Passport is a good example. Even though you can use Passport on any site that offers it, the site ultimately tranfers you to the Passport website momentarily to collect your login and then transfers you back to your site along wth the credentials in a URL variable so your own site can then record the cookie and state you are logged in. It doesn't actually read the Passport cookie from your own site.

If you were to create a DB that applies to multiple sites, you could figure out a way to populate session variables on separate sites by quering the DB for the data if there is no data currently stored, or if it detects that the referer was a different URL prior to loading the current site. Once it queries the data it can store the data in a session variable.