I have an requirement to implement cross-domain login for two web apps (APP1 and APP2) so that a user can access APP2 once they have logged into APP1. APP2 needs to know an ID of the user who is logged into APP1. I have come up with a solution but I'm not sure it's the best way to do it. Could you please take a look at this solution and point out potential vulnerabilities or give me some hints how to get it done in a better way? Here's the solution:
APP1 has a link to the APP2 somewhere on the website. The link contains a login token which is generated by APP1's server, i.e. https://app2.somedomain.com/index.html?login-token=U2FsdGVkX1+S5BDg4DV0nnoq3iIEjAj6Wk48F20GjNWGZDoad8VgAW9nG4ltBV0iQNuFz428yqh6pQ6JcKMIO9c+hy9+BDGfDfqz6tuCqp4=
A login token is a plain text encrypted using a symmetric key algorithm such as AES and an encryption password which is known only by APP1 and APP2. It contains the following information: userId, ip address, timestamp, secret-key, ie. 00001,22.214.171.124,1399725213,secret-key
APP2 receives the request, decrypts the login token using the encryption password and checks the following:
- HTTP referer - it should match to the APP1 server URL
- IP address
- secret-key - both apps share the same secret-key (is not the same as the encryption password) to verify that the request comes from APP1
- whether the login token has been used or not.
APP2 guarantees that a login token can be used only once so it won't be possible to steal a login token and use it to access APP2 from another computer.