How to check for logged in status on a 3rd party site?

Adrian Cotter:

Hoping someone from Convio might look at this!

Your site is currently configured with the multi-domain feature disabled, so it is pushing all cookies to action.sierraclub.org. I don't believe that these cookies will be visible from a page served from another sierraclub.org domain. If the site configuration is changed to push to sierraclub.org, then you should see a cookie name that starts with JServSessionId followed by some additional characters (e.g. JServSessionIdr005). This cookie would indicate that the user has an active session on the Convio powered site. I don't know if this is what you really want to know though. If you want to know if they are "logged in" vs. just visiting, you could look at the content of a PageServer page that just contains ] as its content. If you did that without checking for the cookie though, you would potentially log the person as you checked if they have a "remember me" cookie.

Is this even close to what you're asking.

Adrian Cotter:

Hey Dave, thanks for the reply. I think you're talking about the right thing. We are going to have the Port networks working with Convio though, shortly. I presume that would mean we would have multi-domain turned on?

So, assuming that it will be on, is the cookie number arbitrary to the user? Or is it defined at the site level? (i.e. how would I then access it)

And then assuming I can access it, is the cookies mere presence an indication of a logged in state, or is a field within the cookie? If the latter, what would that field and value be?

Thanks!

Yes, part of configuring the Port integration is to turn on the multi-domain cookies. The numbers at the end of the cookie name are based on the "zone" that your site is running in. The zone is the equivalent of an application version number but drawn from a small pool that we rotate through. It will be the same for every user but will change every few weeks as patches are applied.

The presence of the cookie indicates an active session - no need to interrogate any data within it. It is not a permanent cookie and will be deleted when the session ends. The contents of the cookie is just a random nonce that the web server uses to associate requests back to the same session.

Adrian Cotter:

Hey Dave,

I just reread this today... if the cookie name is changing every few weeks this makes things a tad difficult. Is there any way we can know what that name is without having to find it out manually?

No, it follows a pattern of always startign with JServSessionId, but it changes pretty often.

I spoke with some folks from the Port yesterday, and I may have a different tact on the problem though. I don't really think you want to know if someone is currently logged in; I think you want to know if someone is currently logged in or has a "remember me" cookie that could potentially log them in automatically. So, I've got a few questions for you:

Is that really the question?

Are you just looking to solve it for your Port integration or is this another system?

If it's another system, can you modify the back-end code or just the client HTML?

DavidHart :

Yes, setting a site up for multi-domain will change the cookies to come from a higher level like .example.com. It does a few other things as well, although I can't do a comprehensive list off the top of my head. Only a Convio employee (support analyst or project manager) will have access to this configuration option.

The secure cookies are at a path level (e.g. secure#.convio.net/foo) since multiple clients are typically on the same secure server domain. The code keeps track of the different channels internally so it knows if it needs to push a cookie or not when you switch.

Thanks Dave. Since Convio SSL and non-SSL cookies are on different domains and cross-domain cookies are not permitted by browsers, is Convio passing a session ID around and setting two cookies? Feel free to follow up on the SSL & SSO thread so this one isn't cluttered up any further.