Backend Development
Python Tutorial
How to Redirect with Cookies and Headers Between Domains in HTTP?
How to Redirect with Cookies and Headers Between Domains in HTTP?
Redirecting from One Domain to Another and Setting Cookies or Headers for the Other Domain
The Challenge
Redirection from one domain to another with custom headers or cookies set in the response is not possible due to HTTP protocol limitations. A redirection essentially consists of a header (Location) associated with the response, and it does not allow for any headers to be added to the target location.
Setting cookies for a different domain is also not allowed as it would pose a significant security risk. Browsers store cookies sent by the server with a response using the Set-Cookie header, and later send them back to the server for requests made to the same server within the same domain. Cookies are not sent to a different domain.
Solution 1: Redirect with Query Parameter and Cookie Setting on Target Domain
One approach is to have the source domain redirect the user to the target domain with an access token passed as a query parameter. The target domain can then read the token and set its own cookie, which the browser will store and send for subsequent requests.
Source Domain (appA.py)
<code class="python">from fastapi import FastAPI, Response
from fastapi.responses import RedirectResponse, HTMLResponse
app = FastAPI()
@app.get('/', response_class=HTMLResponse)
def home():
return '''
<!DOCTYPE html>
<html>
<body>
<h2>Click the "submit" button to be redirected to domain B</h2>
<form method="POST" action="/submit">
<input type="submit" value="Submit">
</form>
</body>
</html>
'''
@app.post('/submit')
def submit():
token = 'MTQ0NjJkZmQ5OTM2NDE1ZTZjNGZmZjI3'
redirect_url = f'http://example.test:8001/submit?token={token}'
response = RedirectResponse(redirect_url)
response.set_cookie(key='access-token', value=token, httponly=True)
return response</code>Target Domain (appB.py)
<code class="python">from fastapi import FastAPI, Request, status
from fastapi.responses import RedirectResponse, HTMLResponse
app = FastAPI()
@app.get('/', response_class=HTMLResponse)
def home():
token = request.cookies.get('access-token')
print(token)
return 'You have been successfully redirected to domain B!' \
f' Your access token ends with: {token[-4:]}'
@app.post('/submit')
def submit(request: Request, token: str):
redirect_url = request.url_for('home')
response = RedirectResponse(redirect_url, status_code=status.HTTP_303_SEE_OTHER)
response.set_cookie(key='access-token', value=token, httponly=True)
return response</code>Solution 2: Cross-Origin Communication with Window.postMessage()
Another approach involves using Window.postMessage() for cross-origin communication. The source domain sends the token to the target domain, which stores it in localStorage and sets a cookie. Disadvantages include browser compatibility and the storage of sensitive data in localStorage.
Solution 3: StackExchange Universal Login Approach
A more robust solution is used by StackExchange for auto-login between its different sites. It involves sending an authentication token via an image's src attribute, which triggers a server response and sets cookies on the target site.
This requires browser acceptance of third-party cookies and CORS configuration on the target server. It also sends the token in the query string, posing potential security risks.
Source Domain (appA.py)
<code class="python">from fastapi import FastAPI, Response
from fastapi.responses import HTMLResponse
app = FastAPI()
@app.get('/', response_class=HTMLResponse)
def home():
return '''
<!DOCTYPE html>
<html>
<body>
<h2>Click the "submit" button to be redirected to domain B</h2>
<input type="button" value="Submit" onclick="submit()">
<script>
function submit() {
fetch('/submit', {
method: 'POST',
})
.then(res => {
authHeader = res.headers.get('Authorization');
if (authHeader.startsWith("Bearer "))
token = authHeader.substring(7, authHeader.length);
return res.text();
})
.then(data => {
var url = 'http://example.test:8001/submit?token=' + encodeURIComponent(token);
var img = document.createElement('img');
img.style = 'display:none';
img.crossOrigin = 'use-credentials';
img.onerror = function(){
window.location.href = 'http://example.test:8001/';
}
img.src = url;
})
.catch(error => {
console.error(error);
});
}
</script>
</body>
</html>
'''
@app.post('/submit')
def submit():
token = 'MTQ0NjJkZmQ5OTM2NDE1ZTZjNGZmZjI3'
headers = {'Authorization': f'Bearer {token}'}
response = Response('success', headers=headers)
response.set_cookie(key='access-token', value=token, httponly=True)
return response</code>Target Domain (appB.py)
<code class="python">from fastapi import FastAPI, Request, Response
from fastapi.responses import RedirectResponse
from fastapi.middleware.cors import CORSMiddleware
app = FastAPI()
origins = ['http://localhost:8000', 'http://127.0.0.1:8000',
'https://localhost:8000', 'https://127.0.0.1:8000']
app.add_middleware(
CORSMiddleware,
allow_origins=origins,
allow_credentials=True,
allow_methods=["*"],
allow_headers=["*"],
)
@app.get('/')
def home(request: Request):
token = request.cookies.get('access-token')
print(token)
return 'You have been successfully redirected to domain B!' \
f' Your access token ends with: {token[-4:]}'
@app.get('/submit')
def submit(request: Request, token: str):
response = Response('success')
response.set_cookie(key='access-token', value=token, samesite='none', secure=True, httponly=True)
return response</code>Security Considerations
When transferring tokens or setting cookies between domains, it is crucial to consider security implications. Avoid sending sensitive data in the query string as it can be intercepted or compromised. Use HTTPS connections for secure data transfer. Set the SameSite flag to 'None' with the Secure flag for cross-site access protection.
The above is the detailed content of How to Redirect with Cookies and Headers Between Domains in HTTP?. For more information, please follow other related articles on the PHP Chinese website!
Hot AI Tools
Undresser.AI Undress
AI-powered app for creating realistic nude photos
AI Clothes Remover
Online AI tool for removing clothes from photos.
Undress AI Tool
Undress images for free
Clothoff.io
AI clothes remover
Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!
Hot Article
Hot Tools
Notepad++7.3.1
Easy-to-use and free code editor
SublimeText3 Chinese version
Chinese version, very easy to use
Zend Studio 13.0.1
Powerful PHP integrated development environment
Dreamweaver CS6
Visual web development tools
SublimeText3 Mac version
God-level code editing software (SublimeText3)
Hot Topics
How to solve the permissions problem encountered when viewing Python version in Linux terminal?
Apr 01, 2025 pm 05:09 PM
Solution to permission issues when viewing Python version in Linux terminal When you try to view Python version in Linux terminal, enter python...
How to avoid being detected by the browser when using Fiddler Everywhere for man-in-the-middle reading?
Apr 02, 2025 am 07:15 AM
How to avoid being detected when using FiddlerEverywhere for man-in-the-middle readings When you use FiddlerEverywhere...
How to teach computer novice programming basics in project and problem-driven methods within 10 hours?
Apr 02, 2025 am 07:18 AM
How to teach computer novice programming basics within 10 hours? If you only have 10 hours to teach computer novice some programming knowledge, what would you choose to teach...
How to efficiently copy the entire column of one DataFrame into another DataFrame with different structures in Python?
Apr 01, 2025 pm 11:15 PM
When using Python's pandas library, how to copy whole columns between two DataFrames with different structures is a common problem. Suppose we have two Dats...
How does Uvicorn continuously listen for HTTP requests without serving_forever()?
Apr 01, 2025 pm 10:51 PM
How does Uvicorn continuously listen for HTTP requests? Uvicorn is a lightweight web server based on ASGI. One of its core functions is to listen for HTTP requests and proceed...
How to handle comma-separated list query parameters in FastAPI?
Apr 02, 2025 am 06:51 AM
Fastapi ...
How to solve permission issues when using python --version command in Linux terminal?
Apr 02, 2025 am 06:36 AM
Using python in Linux terminal...
How to get news data bypassing Investing.com's anti-crawler mechanism?
Apr 02, 2025 am 07:03 AM
Understanding the anti-crawling strategy of Investing.com Many people often try to crawl news data from Investing.com (https://cn.investing.com/news/latest-news)...
