Setting a Cookie on a Subdomain from an AJAX Request with PHP

Cross-domain requests have always been a challenging aspect of web development. When it comes to sending AJAX requests from a subdomain to another subdomain, managing cookies can be even more complex. However, with the right techniques and configurations, it’s possible to set cookies on subdomains securely and efficiently. In this article, we’ll explore how to achieve this using PHP, while ensuring proper security measures are in place.

Understanding the Cross-Domain Cookie Challenge

Cross-domain requests can pose a security risk, as they might allow malicious websites to access sensitive data. To mitigate this risk, web browsers enforce a security mechanism known as the “Same-Origin Policy.” This policy restricts web pages from making requests to a domain that is different from the one that served the web page. However, there are legitimate use cases where cross-domain requests are necessary.

In this scenario, we want to set a cookie on a subdomain (e.g., app.yourdomain.com) from an AJAX request originating from another subdomain (e.g., www.yourdomain.com). To achieve this, we need to configure both the server-side and client-side components correctly.

Server-Side Configuration with PHP

On the server side, we need to handle incoming requests and respond with the appropriate headers to allow cross-origin requests and cookie setting. Here’s a PHP code snippet that demonstrates the necessary server-side configuration:

<?php // Enable CORS (Cross-Origin Resource Sharing) to allow requests from other domains.
header('Access-Control-Allow-Credentials: true');
header('Access-Control-Allow-Origin: https://www.yourdomain.com');
// Replace with your domain. // Set the cookie on the subdomain.
$cookieName = 'myCookie'; 
$cookieValue = 'Hello from the subdomain!';
$cookieDomain = '.yourdomain.com'; 
// Notice the leading dot for subdomains.
$cookiePath= '/';
$cookieSecure = true;
// Set to true if using HTTPS.
$cookieHttpOnly = true; // Improve security by preventing JavaScript access.
setcookie($cookieName, $cookieValue, 0, $cookiePath, $cookieDomain, $cookieSecure, $cookieHttpOnly);
// Return a response to the AJAX request.
echo 'Cookie set on subdomain!';

This PHP code snippet does the following:

1. Enables CORS by setting appropriate headers to allow cross-origin requests.
2. Sets a cookie with the specified name, value, and configuration.
3. Responds with a message to confirm that the cookie has been set.

Client-Side Configuration with JavaScript/jQuery

On the client side, you must configure your AJAX request to handle credentials and cross-origin requests properly. Below are two examples: one using jQuery and the other using the Fetch API.

Using jQuery:

$.ajax({ url: 'https://app.yourdomain.com/api.php', 
// Replace with your subdomain API URL.
xhrFields: { 
withCredentials: true // Allow cookies in cross-origin requests. 
},
success: function(response) { console.log(response); // Output: "Cookie set on subdomain!" } });

Using the Fetch API:

fetch('https://app.yourdomain.com/api.php', { credentials: "include" }) .then(response => response.text()) .then(data => {console.log(data); });

In both examples, the key is to include the withCredentials option in your AJAX request configuration. This tells the browser to include any cookies associated with the subdomain when making the request.

Security Considerations

When working with cookies and cross-origin requests, security should be a top priority. Here are some security considerations to keep in mind:

1. Secure Communication: Ensure that your subdomain uses HTTPS to encrypt data in transit.
2. HTTP-Only Cookies: Set the HttpOnly flag on cookies to prevent client-side JavaScript access, which can help mitigate XSS (Cross-Site Scripting) attacks.
3. Domain Scope: Be cautious when setting cookies at a broad domain scope (e.g., .yourdomain.com). Only do this if necessary, as it can expose cookies to other subdomains.
4. Access Control: Restrict the origins allowed to access your subdomain using the Access-Control-Allow-Origin header.
5. Authentication and Authorization: Implement proper authentication and authorization mechanisms to ensure that sensitive data is not exposed to unauthorized parties.

By following these best practices, you can safely set cookies on subdomains from AJAX requests, allowing your web applications to work seamlessly while maintaining security.