We currently have 2 sites
The www site does not have an SSL certificate and is on a different domain.
We have a login button on
http://www.foo.co.uk that when clicked opens up an iframe of
https://secure.foo.com with a form, when the user logs in it creates a session cookie on that domain (
The session cookie then needs to be copied to
foo.co.uk so what it does is redirects you to
http://www.foo.co.uk/setcookie.php?session=abcd1234 which allows us to set the same cookie on the origin domain.
This is not a very secure solution so I have been looking into how to make this better - the best idea I have found is to send a hash using something like
HMAC along with the params to the setcookie.php script and then verify it on the other end before creating the cookie.
Whilst this is better it doesn't prevent man in the middle attacks. Bearing in mind that www is not SSL secured I don't think you can prevent this completely, so the next best thing would be to include a timestamp in the hash to make it valid for 5 minutes.
Does anyone have any ideas on how I can make this better, or point out any pitfalls with this approach? I would be most grateful.