cookie clash

[spookie]

i am confused.
i am setting a cookie with
setcookie("login",$user_name,0,"/"
that means the cookie is applicable from the root of my site.
if the directory structure is like
/home/httpd/html/site1/index.php of my site
now if there is some other domain on
/home/httpd/html/site2/index.php of site 2
and site 2 also sets the cookie with the same name ie login
can the two cookies clash?(the site2 specifies the domain while setting a cookie)
i mean if a user is logged in on one site can it go to the other without login even if the site is checking for cookie $login.

thanking you in advance..

spookie

 

[inlandpac]

Spookie,

Well, this really boils down to browsers, since browsers establish their own standards for accepting, reading, and modifying cookies on the clients' systems.

Netscape is overly protective and picky.

In any case, we have three domains on one server each with document root of

/home/sites/home/web and
/home/sites/home/

http://www and

/home/sites/home/web2 respectively

If we set a cookie in domain mywebsite.com which is in ../web, we cannot access them in ../

http://www nor

in ../web2.

The reason? Well, this is due to security features in cookies (and for good reason!). One good reason why this is so is for the simple fact that on servers where there is virtual hosting (such as ISPs), one owner of one domain definitely does not want his/her cookies accessible by a client viewing some other domain.

If you are trying to get a cookie to be accessible between each one of your domains, good luck. There are ways to do this, but I don't think the methods would be very nice and can cause some huge security holes.

Also, if you are using PHP4, make your life easier by using PHP's session functions for instance:

session_start();

$myname = "Chad Horton";

session_register("myname"


the above starts a session and creates a cookie called myname. The wonderful thing about this is that the PHP's session suite uses the server to store session validation information (PHP session ID's, etc.) in a specified location on the server. When you register a session object (cookie), the information expires when the user closes his/her browser or you kill it yourself with session_unregister().

Hope this helps.

Chad. ICQ: 54380631

 

[spookie]

thanks inlandpac,

no i DONT want the cookie accessible from one site to the other.the two sites are totaly different.it doesnt make sense, isnt it?

i realized it when the cookies by two sites happened to be of same name and since they are client side cookie that thing came into my mind.

is there any security hole in it or should i cahnge the cookie name altogether??

thanks

spookie

 

[inlandpac]

There is no real security hole in the essence of it all, but of course, anything is possible

I would not worry about anything. The one cookie should never clash with the other.

I would still recommend using PHP's session functions.

Chad. ICQ: 54380631