CiviCRM Community Forums (archive)

Hey guys,

I am trying to embed a CiviCRM petition form from a different domain on a page via ajax.
I then would like to submit that form via another ajax request, and embed the response without leaving the page.

The problem: On submit, CiviCRM will complain that it wants cookies enabled.
The message is coming from CRM_Core_Controller::key().

Sorry. A non-recoverable error has occurred.
We can't load the requested web page. This page requires cookies to be enabled in your browser settings. Please check this setting and enable cookies (if they are not enabled). Then try again. If this error persists, contact the site adminstrator for assistance.

Site Administrators: This error may indicate that users are accessing this page using a domain or URL other than the configured Base URL. EXAMPLE: Base URL is http://example.org, but some users are accessing the page via http://www.example.org or a domain alias like http://myotherexample.org.

Error type: Could not find a valid session key.

Not really surprising, this is a typical conflict with cross-domain browser security.
Nevertheless, I would like to find a way to circumvent this problem.

---------------------

Let's say the page is on site A, but the ajax-embedded CiviCRM form comes from site B.

Session id from server to client
The first ajax request (to embed the form) creates a session cookie for site B, which we cannot access via javascript from site A.
Workaround: To make the session id from B available to javascript on site A, we can simply put it into a json variable.

Session id from client to server
By default, ajax requests do not send any cookies.
We could change this with a "xhr.withCredentials" setting, but this does not work for all browsers afaik.
Alternatively, one could try to send the session id (and session name) via GET or POST.

Session id via GET -> problem.
PHP can be configured to accept this, and will correctly initialize the session.
Unfortunately, CiviCRM+Quickform does not so easily grok this cookie-less request on form submissions, at least for the petition form. I am still trying to figure out why.

The petition form (CRM_Campaign_Form_Petition_Signature.php) does something with $_SESSION btw.

Besides, I am not sure about the security implications of sending session id via GET. It is generally recommended not to do this.
Maybe this can be mitigated if I impose some restrictions, such as, one can never log in with a GET session.

--------------

An alternative would be to tunnel the requests in one way or another.

--------

Any thoughts?

Next finding.
You can't have it all. Either jsonp or POST, not both.
Kind of obvious, considering how jsonp works.
http://www.markhneedham.com/blog/2009/08/27/jquery-post-jsonp-and-cross-domain-requests/

But how can we combine POST + cookies?
I guess we can't.
So I need to tweak or tunnel or wrap CiviCRM so it accepts cookies from GET.

2) you ajax submit (using jquery form) that should have the cookie from the session from 1, isn't it?

Nope.
The browser does have the cookie (for the remote domain B). But it will not send the cookie with a POST request.

More precisely:
- The usual ajax xhr does never send cookies to remote sites, unless the cookies are enabled via the "xhr.withCredentials" setting, which is only available on some browsers.
- jsonp does send cookies, but it is not xhr but just a script tag with a url. Thus, it cannot send POST.