<p>I've to admin a small website for my alumni group which is hosted by my ISV. The url is something like www.myIsv.com/myWebSite/ which is quite ugly and very forgetable. The main admin of the webserver has registered a domain name www.mysmallwebsite.com and put a index.html with this content:</p>

<pre><code>&lt;html&gt;
&lt;head&gt;
&lt;title&gt;www.mysmallwebsite.com&lt;/title&gt;
&lt;/head&gt;

&lt;frameset&gt;
   &lt;frame src="http://www.myIsv.com/myWebSite/" name="redir"&gt;
      &lt;noframes&gt;
        &lt;p&gt;Original location:
          &lt;a href="www.myIsv.com/myWebSite/"&gt;http://www.myIsv.com/myWebSite/&lt;/a&gt;
        &lt;/p&gt;
      &lt;/noframes&gt;
 &lt;/frameset&gt;  
&lt;/html&gt;
</code></pre>

<p>It works fine, but some features like PHP Session variables doesn't work anymore! Anyone has a suggestion for correcting that?</p>

<p>Edit:
This doesn't work both on IE and on Firefox (no plugins)</p>

<p>Thanks</p>

[{'answer_id': 38382, 'author': 'Alexandru Nedelcu', 'author_id': 3280, 'author_profile': 'https://Stackoverflow.com/users/3280', 'pm_score': 0, 'selected': False, 'text': "<p>What do you mean?\nAre you saying that when you go from www.mysmallwebsite.com to www.myIsv.com/myWebSite/ then the PHP session is lost?</p>\n\n<p>PHP recognizes the session with an ID (alpha-numeric hash generated on the server). The ID is passed from request to request using a cookie called PHPSESSID or something like that (you can view the cookies a websites sets with the help of your browser ... on Firefox you have Firebug + FireCookie and the wonderful Web Developer Toolbar ... with which you can view the list of cookies without a sweat).</p>\n\n<p>So ... PHP is passing the session ID through the PHPSESSID cookie. But you can pass the session ID as a plain GET request parameters.</p>\n\n<p>So when you place the html link to the ugly domain name, assuming that it is the same PHP server (with the same sessions initialized), you can put it like this ...</p>\n\n<pre><code>www.myIsv.com/myWebSite/?PHPSESSID=&lt;?=session_id()?&gt;\n</code></pre>\n\n<p>I haven't worked with PHP for a while, but I think this will work. </p>\n"}, {'answer_id': 38385, 'author': 'pix0r', 'author_id': 72, 'author_profile': 'https://Stackoverflow.com/users/72', 'pm_score': 0, 'selected': False, 'text': '<p>Do session variables work if you hit <a href="http://www.myIsv.com/myWebSite/" rel="nofollow noreferrer">http://www.myIsv.com/myWebSite/</a> directly?  It would seem to me that the server config would dictate whether or not sessions will work.  However, if you\'re starting a session on www.mysmallwebsite.com somehow (doesn\'t look like you\'re using PHP, but maybe you are), you\'re not going to be able to transfer session data without writing some backend logic that moves the session from server to server.</p>\n'}, {'answer_id': 38390, 'author': 'ftdysa', 'author_id': 2016, 'author_profile': 'https://Stackoverflow.com/users/2016', 'pm_score': 0, 'selected': False, 'text': '<p>Stick a session_start() at the beginning of your script and see if you can access the variables again.</p>\n'}, {'answer_id': 38394, 'author': 'Shawn', 'author_id': 26, 'author_profile': 'https://Stackoverflow.com/users/26', 'pm_score': 0, 'selected': False, 'text': "<p>It's not working because on the client sessions are per-domain. All the cookies are being saved for mysmallwebsite.com, so myIsv.com cannot access them.</p>\n"}, {'answer_id': 38395, 'author': 'Steve Gury', 'author_id': 1578, 'author_profile': 'https://Stackoverflow.com/users/1578', 'pm_score': 0, 'selected': False, 'text': "<p>@pix0r\nwww.myIsv.com/myWebSite/ -> session variable work\nwww.mysmallwebsite.com   -> session variable doesn't work</p>\n\n<p>@Alexandru\nUnfortunately this is not on the same webserver</p>\n"}, {'answer_id': 38397, 'author': 'Re0sless', 'author_id': 2098, 'author_profile': 'https://Stackoverflow.com/users/2098', 'pm_score': 0, 'selected': False, 'text': '<p>What browser/ ad-on do you have? it may be your browser or some other software (may be even the web server) is blocking the sessions from <a href="http://www.myIsv.com/myWebSite/" rel="nofollow noreferrer">http://www.myIsv.com/myWebSite/</a> working from with-in the frame, as its located on a different site, thinking its an XSS attack.</p>\n\n<p>If the session works at <a href="http://www.myIsv.com/myWebSite/" rel="nofollow noreferrer">http://www.myIsv.com/myWebSite/</a> with out the frame you could always us a redirect from <a href="http://www.mysmallwebsite.com" rel="nofollow noreferrer">http://www.mysmallwebsite.com</a> to the ugly url, instead of using the frame.</p>\n\n<p>EDIT:\nI have just tried your frame code on a site of mine that uses sessions, firefox worked fine, with me logging in and staying loged in, but IE7 logged me straight out again.</p>\n'}, {'answer_id': 38417, 'author': 'Orion Edwards', 'author_id': 234, 'author_profile': 'https://Stackoverflow.com/users/234', 'pm_score': 0, 'selected': False, 'text': "<blockquote>\n<p>So when you place the html link to the ugly domain name, assuming that it is the same PHP server (with the same sessions initialized), you can put it like this ...</p>\n<p><code>www.myIsv.com/myWebSite/?PHPSESSID=&lt;?=session_id()?&gt;</code></p>\n</blockquote>\n<p>From a security point of view, I really really really hope that doesn't work</p>\n"}, {'answer_id': 38609, 'author': 'James Inman', 'author_id': 393028, 'author_profile': 'https://Stackoverflow.com/users/393028', 'pm_score': 0, 'selected': False, 'text': "<p>You could also set a cookie on the user-side and then check for the presence of that cookie directly after redirecting, which if you're bothered about friendly URLs would mean that you don't have to pass around a PHPSESSID in the query string.</p>\n"}, {'answer_id': 38774, 'author': 'UnkwnTech', 'author_id': 115, 'author_profile': 'https://Stackoverflow.com/users/115', 'pm_score': 0, 'selected': False, 'text': '<p>When people arrive @ www.mysmallwebsite.com I would just redirect to <a href="http://www.myIsv.com/myWebSite/" rel="nofollow noreferrer">http://www.myIsv.com/myWebSite/</a></p>\n\n<pre><code>&lt;?php header(\'Location: http://www.myIsv.com/myWebSite/\'); ?&gt;\n</code></pre>\n\n<p>This is all I would have in www.mysmqllwebsite.com/index.php<br />\nThis way you dont have to worry about browsedr compatibility, or weather the sessions work, just do the redirct, and you\'ll be good.</p>\n'}, {'answer_id': 38924, 'author': 'paan', 'author_id': 2976, 'author_profile': 'https://Stackoverflow.com/users/2976', 'pm_score': 3, 'selected': True, 'text': '<p>Sessions are tied to the server <strong>AND</strong> the domain. Using frameset across domain will cause all kind of breakage because that\'s just not how it was designed to do. </p>\n\n<p>Try using apache mod rewrite to create a "passthrough redirection", the "<strong>proxy</strong>" flag ([P]) in the rule is the magic flag that you need</p>\n\n<p>Documentation at  <a href="http://httpd.apache.org/docs/1.3/mod/mod_rewrite.html" rel="nofollow noreferrer">http://httpd.apache.org/docs/1.3/mod/mod_rewrite.html</a></p>\n'}]
['https://Stackoverflow.com/questions/38370', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/1578/']