laravel share cookie / session between two subdomains

@t0berius take a look at Torch by Matt Stauffer (from Tighten)

• https://github.com/mattstauffer/Torch

More specifically at this component:

• https://github.com/mattstauffer/Torch/tree/master/components/session

This also came up on the first Google results for this search string: "share laravel session with other php project"

• https://developpaper.com/question/laravel-project-and-other-project-sharing-session-problem/

Look at the accepted answer

@t0berius

I guess you can also require illuminate/redis as they do on their Cache component:

• https://github.com/mattstauffer/Torch/blob/e4553b659f062106cb38894ff6f8f014ab08a60a/components/cache/composer.json#L7

@t0berius by default Laravel uses AES-256-CBC.

But you can verify which your project is using on your ./config/app.php under the cypher key.

https://github.com/laravel/laravel/blob/e077976680bdb2644698fb8965a1e2a8710b5d4b/config/app.php#L126

One more tip that just crossed my mind that might help you.

In your ./config/app.php there is a providers key where you list all Service Providers used to boot up your Laravel app.

One of them is the Illuminate\Encryption\EncryptionServiceProvider::class

So you can refer to this class to see how Laravel constructs the Encrypter class and try to mimic the same parameters on your non-Laravel app.

More precisely take a look here:

https://github.com/laravel/framework/blob/fef02606d1760d0ab6f9287b03c671fa4392998c/src/Illuminate/Encryption/EncryptionServiceProvider.php#L27-L34

@t0berius see my last message I before seeing your new one. The EncryptionServiceProvider might have your answer on how to handle the key properly:

https://github.com/laravel/framework/blob/fef02606d1760d0ab6f9287b03c671fa4392998c/src/Illuminate/Encryption/EncryptionServiceProvider.php#L58-L65

<?php

$key = 'base64:95jv9aonvqQgLbwKVIFhALjSw/XaQmu+EB+RlaSp5/4=';

$decoded = base64_decode(substr($key, 7));

It will produce strange strings, but for the encrypter it does not matter, as long as it when encrypts or decrypts the same data from your Laravel app, it produces the same results.

@t0berius

Well, in your non-PHP project you should include the same version of illuminate/encryption you are using on your Laravel project.

I made this sample artisan command so you can use as an example, but now that I see your last comment it is not much different from your code sample:

Artisan::command('test-encryption', function () {
    // This will use the Encrypter built by in your laravel App
    $laravelEncrypter = app(\Illuminate\Encryption\Encrypter::class);

    $key = config('app.key');
    $cipher = config('app.cipher');

    // substr here is assuming your key is prefixed with "base64:"
    // which has 7 characters. If you are not using a "base64:"
    // key you can remove it
    $decodedKey = base64_decode(substr($key, 7));

    // This will new up a fresh Encrypter as you would \
    // on your non-Laravel project
    $builtUpEncrypter = new \Illuminate\Encryption\Encrypter($decodedKey, $cipher);

    $data = 'Hello world!';

    // encryption produces different results in each run
    $laravelEncrypted = $laravelEncrypter->encrypt($data);
    $builtUpEncrypted = $builtUpEncrypter->encrypt($data);

    // but decrypting using the other Encrypter output
    // should result back in the same data
    $laravelDecrypted = $laravelEncrypter->decrypt($builtUpEncrypted);
    $builtUpDecrypted = $builtUpEncrypter->decrypt($laravelEncrypted);

    if (hash_equals($laravelDecrypted, $builtUpDecrypted)) {
        $this->info('match');
    } else {
        $this->error('fail');
    }
});

@t0berius

The front part is HMAC signature to check if the cookie has not been tampered.

I got so intrigued on how it works, I got this test script:

<?php

require __DIR__ . '/vendor/autoload.php';

use Illuminate\Cookie\CookieValuePrefix;
use Illuminate\Encryption\Encrypter;

$key = 'base64:95jv9aonvqQgLbwKVIFhALjSw/XaQmu+EB+RlaSp5/4=';
$decodedKey = base64_decode(substr($key, 7));

$encrypter = new Encrypter($decodedKey, 'AES-256-CBC');

$cookieName = 'laravel_session';
$cookieValue = $_COOKIE[$cookieName];

// check your EncryptCookies::$serialize value
// if this property is not overriden
// the default on the base Middleware is false
$payload = $encrypter->decrypt($cookieValue, false);

$hasValidPrefix = strpos(
    $payload,
    CookieValuePrefix::create($cookieName, $encrypter->getKey())
) === 0;

if (! $hasValidPrefix) {
    die('Fail');
}

$sessionFilename = CookieValuePrefix::remove($payload);

// I am using the file driver as an example here
// As you are using Redis you will need
// to use a different method
$sessionPayload = file_get_contents(
    __DIR__ . '/storage/framework/sessions/' . $sessionFilename
);
$sessionContent = unserialize($sessionPayload);

die(var_export($sessionContent, true));

I checked these files:

• Illuminate\Cookie\Middleware\EncryptCookies
• Illuminate\Encryption\EncryptionServiceProvider

To get to the final result. Hope this helps.

Forgot the output:

$ php test.php
array (
  '_token' => 'ppOcY2xTAgQt4BE4mMBioeVfL92JU8b6ufo9o285',
  'password_hash_web' => 'y$X5FFcYvf9xc71xDt0V3gKOzEC7cnxCmiskpQu8Uoz1e.6BIRmNzwa',
  '_previous' =>
  array (
    'url' => 'http://127.0.0.1/dashboard',
  ),
  '_flash' =>
  array (
    'old' =>
    array (
    ),
    'new' =>
    array (
    ),
  ),
  'login_web_59ba36addc2b2f9401580f014c7f58ea4e30989d' => 1,
)

@t0berius you're welcome =)

It was fun, and I ended up learning one more thing or two.

Have a nice day

@t0berius on my last snippet there is this line:

$sessionContent = unserialize($sessionPayload);

The format is a serialized PHP notation. The unserialize(…) call parses it and brings it back to an array.

@t0berius for some reason it seems it is double serialized... maybe Laravel does it on the Redis driver...

Try this:

$content = unserialize(unserialize($rawFromRedis));

and see if it works.

The format, although not easy to parse manually, is actually not that hard to grasp.

• In your first snippet it starts with s:267:"..."; which translates to: a string with 267 characters
• Then In your second snippet it starts with a:5:{...} which translates to: an array with 5 elements
• then it has a pair of two strings for each array element, first key is s:6:"_token"; which translates to _token and first value is s:40:"hoMTU9DTbJLTy4P80OUjmKpHNxEnCDNtL526u4Yr"; which translates to hoMTU9DTbJLTy4P80OUjmKpHNxEnCDNtL526u4Yr

and so on.

Fixing some counts you might have changed to obfuscate your real data:

<?php

$rawData = 's:264:"a:5:{s:6:"_token";s:40:"hoMTU9DTbJLTy4P80OUjmKpHNxEnCDNtL526u4Yr";s:9:"_previous";a:1:{s:3:"url";s:24:"http://local.domain/test";}s:6:"_flash";a:2:{s:3:"old";a:0:{}s:3:"new";a:0:{}}s:50:"login_web_59ba36addc2b2f9401580f014c7f58ea4e30989d";i:2;s:9:"some_data";i:1;}";';

$unserialized = unserialize(unserialize($rawData));

var_dump($unserialized);

$ php test.php 
array(5) {
  ["_token"]=>
  string(40) "hoMTU9DTbJLTy4P80OUjmKpHNxEnCDNtL526u4Yr"
  ["_previous"]=>
  array(1) {
    ["url"]=>
    string(24) "http://local.domain/test"
  }
  ["_flash"]=>
  array(2) {
    ["old"]=>
    array(0) {
    }
    ["new"]=>
    array(0) {
    }
  }
  ["login_web_59ba36addc2b2f9401580f014c7f58ea4e30989d"]=>
  int(2)
  ["some_data"]=>
  int(1)
}

I am wondering if you are using the predis/predis package in your Laravel project, if it is who serializes the second time.

You should try to use the same Redis driver on your non-Laravel project

@t0berius Great that you could make it working.

And it seems Laravel is double serializing it

one time in the session handler:

• https://github.com/laravel/framework/blob/30e341b7fe4e4d9019df42b7eff6c7dfa5ea30e5/src/Illuminate/Session/Store.php#L119-L133

and a second time in the Redis cache store:

• https://github.com/laravel/framework/blob/30e341b7fe4e4d9019df42b7eff6c7dfa5ea30e5/src/Illuminate/Cache/RedisStore.php#L90-L103