Javascript 如何为另一个域设置 cookie

How to set a cookie for another domain

提问by Rasoul Zabihi

Say I have a website called a.com, and when a specific page of this site is loaded, say page link, I like to set a cookie for another site called b.com, then redirect the user to b.com.

假设我有一个名为 的网站a.com，当加载该网站的特定页面时，比如说页面链接，我喜欢为另一个名为 的网站设置 cookie b.com，然后将用户重定向到b.com.

I mean, on load of a.com/linkI want to set a cookie for b.comand redirect user to b.com.

我的意思是，在加载时a.com/link我想为 cookie 设置一个 cookieb.com并将用户重定向到b.com.

I tested it, and browser actually received the cookie from a.com/link, but it didn't send that cookie on the redirection request to b.com. Is it normal?

我对其进行了测试，并且浏览器实际上从 接收了 cookie a.com/link，但它没有在重定向请求中将该 cookie 发送到b.com。正常吗？

Can we set cookies for other domains?

我们可以为其他域设置 cookie 吗？

采纳答案by qbert220

You cannot set cookies for another domain. Allowing this would present an enormous security flaw.

您不能为另一个域设置 cookie。允许这样做会带来巨大的安全漏洞。

You need to get b.com to set the cookie. If a.com redirect the user to b.com/setcookie.php?c=value

您需要获取 b.com 来设置 cookie。如果 a.com 将用户重定向到b.com/setcookie.php?c=value

The setcookie script could contain the following to set the cookie and redirect to the correct page on b.com

setcookie 脚本可以包含以下内容来设置 cookie 并重定向到 b.com 上的正确页面

<?php
    setcookie('a', $_GET['c']);
    header("Location: b.com/landingpage.php");
?>

回答by Jonathan

Similar to the top answer, but instead of redirecting to the page and back again which will cause a bad user experience you can set an image on domain A.

与最佳答案类似，但您可以在域 A 上设置图像，而不是重定向到页面并再次返回这会导致糟糕的用户体验。

<img src="http://www.example.com/cookie.php?val=123" style="display:none;">

And then on domain B that is example.com in cookie.php you'll have the following code:

然后在域 B 上，即 cookie.php 中的 example.com，您将拥有以下代码：

<?php
    setcookie('a', $_GET['val']);
?>

Hattip to Subin

Hattip到李苏滨

回答by Ondrej Bozek

Probaly you can use Iframefor this. Facebook probably uses this technique. You can read more on this here. Stackoverflow uses similar technique, but with HTML5 local storage, more on this on their blog

Probaly你可以用Iframe这个。Facebook 可能使用了这种技术。您可以在此处阅读更多相关信息。Stackoverflow 使用类似的技术，但使用 HTML5 本地存储，更多信息请参见他们的博客

回答by Patrik

Setting cookies for another domain is not possible.

无法为另一个域设置 cookie。

If you want to pass data to another domain, you can encode this into the url.

如果要将数据传递到另一个域，可以将其编码到 url 中。

a.com  ->  b.com/redirect?info=some+info (and set cookie) -> b.com/other+page

回答by Quentin

You can't, at least not directly. That would be a nasty security risk.

你不能，至少不能直接。这将是一个令人讨厌的安全风险。

While you can specify a Domain attribute, the specificationsays "The user agent will reject cookies unless the Domain attribute specifies a scope for the cookie that would include the origin server."

虽然您可以指定Domain 属性，但规范说“用户代理将拒绝 cookie，除非 Domain 属性指定了包含源服务器的 cookie 范围。”

Since the origin server is a.comand that does not include b.com, it can't be set.

由于源服务器是a.com并且不包括b.com，因此无法设置。

You would need to get b.comto set the cookie instead. You could do this via (for example) HTTP redirects to b.comand back.

您需要改为b.com设置 cookie。您可以通过（例如）HTTP 重定向来执行此操作b.com。

回答by stop-cran

In case you have a.my-company.comand b.my-company.cominstead of just a.comand b.comyou can issue a cookie for .my-company.comdomain - it will be accepted and sent to both of the domains.

如果您拥有a.my-company.comandb.my-company.com而不仅仅是a.com并且b.com您可以为.my-company.com域发出 cookie - 它将被接受并发送到两个域。

回答by Roy Ling

see RFC6265:

见RFC6265：

The user agent will reject cookies unless the Domain attribute specifies a scope for the cookie that would include the origin server. For example, the user agent will accept a cookie with a Domain attribute of "example.com" or of "foo.example.com" from foo.example.com, but the user agent will not accept a cookie with a Domain attribute of "bar.example.com" or of "baz.foo.example.com".

NOTE: For security reasons, many user agents are configured to reject Domain attributes that correspond to "public suffixes". For example, some user agents will reject Domain attributes of "com" or "co.uk". (See Section 5.3 for more information.)

除非 Domain 属性为包含源服务器的 cookie 指定了一个范围，否则用户代理将拒绝 cookie。例如，用户代理将接受来自 foo.example.com 的域属性为“example.com”或“foo.example.com”的 cookie，但用户代理不会接受域属性为“bar.example.com”或“baz.foo.example.com”。

注意：出于安全原因，许多用户代理被配置为拒绝对应于“公共后缀”的域属性。例如，一些用户代理会拒绝“com”或“co.uk”的域属性。（有关更多信息，请参阅第 5.3 节。）

But the above mentioned workaround with image/iframe works, though it's not recommended due to its insecurity.

但是上面提到的 image/iframe 解决方法是有效的，尽管由于其不安全性，不推荐使用。

回答by cSn

You can't, but... If you own both pages then...

你不能，但是......如果你拥有这两个页面，那么......

1) You can send the data via query params (http://siteB.com/?key=value)

1）您可以通过查询参数发送数据（http://siteB.com/?key=value）

2) You can create an iframe of Site B inside site A and you can send post messages from one place to the other. As Site B is the owner of site B cookies it will be able to set whatever value you need by processing the correct post message. (You should prevent other unwanted senders to send messages to you! that is up to you and the mechanism you decide to use to prevent that from happening)

2) 您可以在站点 A 内创建站点 B 的 iframe，并且您可以将帖子消息从一个地方发送到另一个地方。由于站点 B 是站点 B cookie 的所有者，因此它可以通过处理正确的发布消息来设置您需要的任何值。（您应该阻止其他不需要的发件人向您发送消息！这取决于您和您决定用来防止这种情况发生的机制）

回答by Hariharan AR

In this link, we will find the solution Link.

在此链接中，我们将找到解决方案Link。

setcookie("TestCookie", "", time() - 3600, "/~rasmus/", "b.com", 1);

回答by user10398534

Send a POST request from A. Post requests are on the serverside only and can't be accessed by the client.

从 A 发送 POST 请求。 Post 请求仅在服务器端，客户端无法访问。

You can send a POST request from a.comto b.comusing CURL (recommended, serverside) or a hidden method="POST"form (clientside). If you go for the latter, you might want to obfuscate your JavaScript so that the user won't be able to understand the algorithm and interfere with it.

您可以发送POST请求a.com到b.com使用curl（推荐，服务器端）或隐藏的method="POST"形式（客户方）。如果你选择后者，你可能想要混淆你的 JavaScript，这样用户将无法理解算法并干扰它。

Make a gateway on b.comto set cookies:

创建一个网关b.com来设置 cookie：

<?php
    if (isset($_POST['data']) {
        setcookie('a', $_POST['data']);
        header("Location: b.com/landingpage");
    }
?>

If you want to bring security a step further, implement a function on both sides (a.comand b.com) to encrypt (on a.com) and decrypt (on b.com) data using a cryptographic cypher.

如果您想进一步提高安全性，请在双方 (a.com和b.com)上实现一个函数，以使用加密密码来加密 (on a.com) 和解密 (on b.com) 数据。

If you're trying to do something that must be absolutely secure (e.g. transfer a login session) try oAuthor take some inspiration from https://api.cloudianos.com/docs#v2/auth

如果您正在尝试做一些必须绝对安全的事情（例如传输登录会话），请尝试oAuth或从https://api.cloudianos.com/docs#v2/auth 中获取一些灵感