Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have an requirement to implement cross-domain login for two web apps (APP1 and APP2) so that a user can access APP2 once they have logged into APP1. APP2 needs to know an ID of the user who is logged into APP1. I have come up with a solution but I'm not sure it's the best way to do it. Could you please take a look at this solution and point out potential vulnerabilities or give me some hints how to get it done in a better way? Here's the solution:

  1. APP1 has a link to the APP2 somewhere on the website. The link contains a login token which is generated by APP1's server, i.e. https://app2.somedomain.com/index.html?login-token=U2FsdGVkX1+S5BDg4DV0nnoq3iIEjAj6Wk48F20GjNWGZDoad8VgAW9nG4ltBV0iQNuFz428yqh6pQ6JcKMIO9c+hy9+BDGfDfqz6tuCqp4=

  2. A login token is a plain text encrypted using a symmetric key algorithm such as AES and an encryption password which is known only by APP1 and APP2. It contains the following information: userId, ip address, timestamp, secret-key, ie. 00001,87.143.203.12,1399725213,secret-key

  3. APP2 receives the request, decrypts the login token using the encryption password and checks the following:

    • HTTP referer - it should match to the APP1 server URL
    • IP address
    • secret-key - both apps share the same secret-key (is not the same as the encryption password) to verify that the request comes from APP1
    • whether the login token has been used or not.
  4. APP2 guarantees that a login token can be used only once so it won't be possible to steal a login token and use it to access APP2 from another computer.

share|improve this question

2 Answers 2

I would use an open source implementation of OAuth. Even better, you could use a 3rd party OAuth provider so that you don't have to worry about leaking your customer's credentials in the event of a compromise.

share|improve this answer
    
Thanks Rook. I've been thinking about OAuth but it might be a problem to get guys behind APP1 to implement OAuth. I don't want to go into details here, I was just wondering if there's any simpler solution which would be secure enough. –  janusz Nov 9 '12 at 15:49
2  
@janusz i would strongly advise against building your own crypto system, this is the most complex and risky thing you could do. Leave that to the cryptographers. –  Rook Nov 9 '12 at 16:23

I agree with the recommendation to use OAuth.

For analysis of your proposal, I recommend you read the following blog post:

share|improve this answer
    
Thanks, I guess I will take a closer look into OAuth. –  janusz Nov 12 '12 at 8:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.