Disadvantages of sharing Django sessions across multiple subdomains

Question

I built a Django site using Framework sites and four sites on different subdomains. Lets call them one.mydomain.com; two.mydomain.com ... etc.

Three of the sites are product sites, and one is a store. I want to be able to exchange sessions on sites so that the user cannot log in again when switching from any of the product’s sites to the store. I understand that I can use cas to achieve single sign-on, but I do not think that this meets all my goals.

I read this post and this post about sharing sessions through subdomains, and there seems to be consensus that this is a bad idea.

In my case, I want the user to be able to add items to the basket on one subdomain, and then go to the basket for verification. I see no way to do this without sharing sessions. The user should also be able to add to his cart from another product site, and during verification, a product from one .mydomain.com, a product from two.mydomain.com, etc. will be displayed.

So my question is, why is sharing sessions a bad idea besides potential conflicts? Assuming that I guarantee that the only conflicts that occur (and this should happen) are login information.

My setting has SECRET_KEY common to all sites, and SESSION_COOKIE_DOMAIN = '. mydomain.com '. Is there a serious security bug that I am missing in this setup?

thanks. / w

Answer 1

It seems to me that this is a security flaw in cases where you do not control all the subdomains of a particular domain. For example, you have one.mydomain.com and two.mydomain.com, but the browser will provide your cookie also on bad.mydomain.com, since your settings have SESSION_COOKIE_DOMAIN = '. Mydomain.com '.

Another potential hole will occur if you save the development environment as one of the subdomains (for example, dev.mydomain.com). You will not be isolated if this happens.

As far as I have studied this question, it seems that in the worst case you could issue your cookies for rogue subdomains, so potentially someone could capture a real session using this cookie.

I'm currently doing further research on how best to isolate different subdomains (controlled by the same Django instance), but there seems to be no real way to do this other than rewriting SessionMiddleware.

Answer 2

Of the many things I read, this is considered a bad idea, it seems that you can find errors very hard if you try to share sessions between sites. As far as I know, it is usually best to do things as stateless as possible.