sharing cookie across domains...possible in asp, how about perl?

[spewn]

i'm trying to set up pixel tracking, and i set a cookie once a user clicks on my link (domain1.com). after the cookie is set, the user is sent to a different website (domain2.com) to perform a function.

at that website (domain2.com), after function is performed, they are taken to a thank you page (still on domain2.com), where my pixel/perl script is fired.

what i want to do is access the cookie that i set on domain1.com from domain2.com.

i've seen many times that this isn't possible, but it appears to be possible in asp, so is there a work around in perl?

any ideas?

i'm actually open to any other suggestions, too.

thanks!

- g

 

[Kirsle]

If it really is possible in ASP, then it would be possible in Perl too, since cookies are a part of the HTTP spec (or at least the CGI part of it) and would be independent of the backend code.

I know it's possible to share cookies among *subdomains*, for example if you're on alpha.mydomain.com then a cookie set there could be read by beta.mydomain.com, by adding the "domain" attribute to the cookie, i.e.

my $cookie = $cgi->cookie (
   -name => "name",
   -value => "secret",
   -domain => ".mydomain.com",
);
print $cgi->header(-cookie => $cookie);

Then anything under ".mydomain.com" would be able to read that cookie (if you set it to a specific domain, ie. "alpha.mydomain.com", then only alpha.mydomain.com can read it -- this is the default behavior of cookies when no explicit domain is set).

So, this is just a wild idea, but maybe setting -domain to ".com" would allow any .com domain to read the cookie. Theoretically speaking, since "com" itself is a domain just like any other, it would be theoretically possible to do this. However it would be very insecure since every .com domain would be able to do this.

Alternatively, if the two domains share the same database, you can create a serverside cookie, and when domain1 redirects them to domain2, it can pass their cookie ID in the query string, and the domain2 can look up their cookie from that and then set an HTTP cookie for them so that it will continue remembering their session.

Cuvou.com | My personal homepage

perl -e '$|=$i=1;print" oo\n<|>\n_|_";x:sleep$|;print"\b",$i++%2?"/":"_";goto x;'

 

[KevinADC]

Won't work, if it is possible with ASP then its call hacking. Kirsles suggestion will also not work. Domain names must contain at least two periods to prevent attempts to match on top level domains, like ".com". Otherwise it would be simple to read the cookies from other domains.

------------------------------------------
- Kevin, perl coder unexceptional!