# התחברות ל-Discourse באמצעות אסימון קובץ Cookie

**URL:** https://meta.discourse.org/t/discourse-login-by-cookie-token/227753
**Category:** SSO
**Created:** [22 במאי,‏ 2022,‏ 10:52am UTC](https://meta.discourse.org/t/discourse-login-by-cookie-token/227753 "2022-05-22T10:52:49Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![LeBlanc](https://avatars.discourse-cdn.com/v4/letter/l/e9bcb4/32.png) [@LeBlanc](https://meta.discourse.org/u/LeBlanc)
#### Post date: [22 במאי,‏ 2022,‏ 10:52am UTC](https://meta.discourse.org/t/discourse-login-by-cookie-token/227753/1 "2022-05-22T10:52:50Z")

</div>

We use Discourse as our community site and we have a we have an official web site .  
So, we hope that discourse can be automatically logged on after user logged on our official website .  
Our official website will add a cookie when user loggin and we use cookie sharing in discourse . Discourse get authorization in cookie , and get user info to login.  
The code implementation is as follows：

```plaintext
application_controller.rb
  before_action :check_cookie_login
  def check_cookie_login
    if !current_user && cookies[:authorization]
      external_id = get_external_id cookies[:authorization]
      cookie_log_on_user external_id
    end
  end

```

```plaintext
current_user.rb
 def cookie_log_on_user(external_id)
    sso_record = SingleSignOnRecord.find_by(external_id: external_id)
    user = sso_record.user
    log_on_user(user)
  end

```

```plaintext
default_current_user_provider.rb
 def log_off_user(session, cookie_jar)
    ……
   cookie_jar.delete('authorization')
 end

```

I wonder if there’s anything wrong with me doing this? Is there a better way？

---

<div class="post-metadata">

### Author: ![michaeld](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/michaeld/32/1594_2.png) [@michaeld](https://meta.discourse.org/u/michaeld)
#### Post date: [22 במאי,‏ 2022,‏ 4:04pm UTC](https://meta.discourse.org/t/discourse-login-by-cookie-token/227753/2 "2022-05-22T16:04:36Z")

</div>

This is insecure. A user could tamper with the cookie in their browser and log in as someone else.

You should use [DiscourseConnect](https://meta.discourse.org/t/13045?silent=true) instead.

---

<div class="post-metadata">

### Author: ![LeBlanc](https://avatars.discourse-cdn.com/v4/letter/l/e9bcb4/32.png) [@LeBlanc](https://meta.discourse.org/u/LeBlanc)
#### Post date: [23 במאי,‏ 2022,‏ 5:40am UTC](https://meta.discourse.org/t/discourse-login-by-cookie-token/227753/3 "2022-05-23T05:40:08Z")

</div>

Thanks for your suggestion. I am a newbie for Discourse . If i use [DiscourseConnect](https://meta.discourse.org/t/13045) instead it , should I have an web api to return a nonce that [DiscourseConnect](https://meta.discourse.org/t/13045) needs？