All geek questions in one place

Using Cross-Domain Form Authentication

here is our problem .. We created an MVC Web-api that uses cookie authentication forms to handle sessions. When we use our front-end web page in the same domain (localhost or web-server) as web-api, everything works fine. (We use jQuery $ .get and $ .post to communicate with web-api).

Although the interface in the future should be a standalone html5 application, not located in the same domain as the web-api. Unfortunately this does not work.

The web-api returns authentication to the client, but the cookie does not return to the web-api when the external interface sends it. When both web api and front-end are in the same domain, a cookie is automatically sent with a request.

We tried the "Access Control-Allow-Origin: *" and "Access Control-Allow-Authentication: true" settings in the webconfig web-api file.

+6
source share
1 answer

You need single sign-on (SSO).

The browser will only use cookies in the same domain, so it did not work when applications are located in different domains.

CodeProject has a good article on SSO implementation in ASP.NET - http://www.codeproject.com/Articles/106439/Single-Sign-On-SSO-for-cross-domain-ASP-NET-applic , which also applies to ASP.Net MVC.

+4
source

Source: https://habr.com/ru/post/915970/

More articles:


All Articles