Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p><strong>vhost configuration</strong></p> <p>The above configuration snippet simply sets up two <a href="http://httpd.apache.org/docs/2.2/en/vhosts/" rel="nofollow noreferrer">virtualHosts</a> in Apache. Each of them point to the same documentRoot - this is the folder which will be the websites root folder. No redirection in place. Vhosts are the correct solution.</p> <p><strong><em>EDIT1</em></strong> If you want to generally use the same files for all vhosts but with single exceptions you can either rewrite the request using <a href="http://httpd.apache.org/docs/2.2/mod/mod_rewrite.html" rel="nofollow noreferrer">mod_rewrite</a> or <a href="http://httpd.apache.org/docs/2.2/mod/mod_alias.html" rel="nofollow noreferrer">mod_alias</a> in each of your vhosts</p> <p>e.g. <code>domain.com/favicon.ico</code> could be read from <code>document_root/specific/domain.com/favicon.ico</code> </p> <p><strong>SSL certificates</strong></p> <p>Unless your customers share a domain using subdomains you will need a SSL certificate for each vhost. In case they just get a subdomain, you can buy one wildcard certificate *.yourdomain.com</p> <p>The problem with several domains is, that you need one IP per vhost in order to use different SSL certificates: <a href="https://stackoverflow.com/questions/276134/how-can-i-setup-different-ssl-certificates-for-vhosts-on-apache">How can I setup different SSL-Certificates for vhosts on Apache?</a></p> <p><strong>Sessions</strong></p> <p>Your application will need to check the domain. A cookie is set for a specific domain but the client could just "move" the session to another domain by manipulating the cookie. Anyway I don't think you want to allow all users on all domains, so a check will be required at the credential checking already. In addition you can save the domain into the session and terminate the session when the domain changes</p> <pre><code>session_start(); if ( user_authorized_with_credentials_and_domain ) { $_SESSION['sess_domain'] = $_SERVER['HTTP_HOST']; } </code></pre> <p>On later requests you can compare</p> <pre><code>if ( $_SESSION['sess_domain'] !== $_SERVER['HTTP_HOST'] ) { session_destroy(); // redirect to login } </code></pre>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload