nerdzeu/nerdz.eu — pull request #157 by Robertof (2014-05-01 00:11:59+00:00)
Title: Major changes to the login infrastructure

The login system has been improved, and you need to adjust your configuration if you have enabled `https` login. Changelog:

- Refactored `mobileSplashScreen()`. It was *ugly*.
- New function in the core class: `getSafeCookieDomainName()` which returns a safe-to-use domain name for cookies. It strips the `www.` from the existing `SITE_NAME` variable, and if we are dealing with `localhost` we just return `null` (which is still safe to use in cookies).
- The `$secure` variable of the cookies is now **ALWAYS** set to `false`. This allows to share cookies between `https` and non-`https` sessions (mobile included).
- CORS behavior changed: now the login requests are sent with the `withCredentials` variable, which means that cross-domain requests are now allowed to set cookies. However, **an update to your webserver configuration is needed if you are using `https`-only login.** You need to send the `Access-Control-Allow-Credentials: true` **along with** the standard `Access-Control-Allow-Origin: ...`.
- A PHP snippet has been added to the configuration which allows to easily configure CORS without editing your webserver's configuration. Please read the updated comments.

NOTE: **lots and lots** of blasphemies were screamed while developing this source code. Please ensure that there are no extreme rage lines.