Re: A perl session question

There is no good reason to do a redirect before setting the cookie.

On every page you display, the login form can send its data (as POST please) directly to http://homesite.com/login.cgi instead of first going through http://non-homesite/login.cgi

After the authentication was successful, you can still do a redirect.

Perl 6 - links to (nearly) everything that is Perl 6.

Comment on Re: A perl session question Select or Download Code

Replies are listed 'Best First'.
Re^2: A perl session question by rajivp (Novice) on Jul 14, 2010 at 06:28 UTC
May be I did not explain this correctly. The home site could be different for different users. Say I have a.com, b.com and c.com as the group of sites. And say I have user X and user Y. For user X the home site could be be a.com, while for user Y the home site could be c.com - If user X logs into c.com, I need to redirect him/her to a.com. Likewise, if user Y logs in to a.com or b.com, I need to redirect him to c.com So up front, I do not know what the home site would be. It is only after I have a userid, I look up the home site based on user id and redirect to appropriate home site. It is possible to re-present the login screen but that would not be an automatic login.	[reply]
Re^3: A perl session question by moritz (Cardinal) on Jul 14, 2010 at 06:37 UTC
I'd find it a bit weird to log into a site and end up on a different site, but that's your choice of course. One way around is to do it as you do it now, but encrypt the password with something like Crypt::CBC. You just need to a common, secret key or passphrase on all three servers. This doesn't scale to sites that don't trust each other, in which case you need something more complicated, like for example OpenID. Perl 6 - links to (nearly) everything that is Perl 6.	[reply]
Re^4: A perl session question by rajivp (Novice) on Jul 14, 2010 at 07:37 UTC
It is just that each site is customized for a certain section of the population, based on demographics. A user would be most comfortable in his or her home site. Even though the database for all the sites is the same, a user would mostly be browsing the sub set of data applicable to him or her. To keep things simple, we decided to restrict the user's access to the data through only one site. The idea is to restrict the user to his or her home site. I am not very familiar with openID, so I am not sure whether that will work I will take a look at Crypt::CBC - I do appreciate your time and advice.	[reply]