Secure login across two web apps

Question

I have an requirement to implement cross-domain login for two web apps (APP1 and APP2) so that a user can access APP2 once they have logged into APP1. APP2 needs to know an ID of the user who is logged into APP1. I have come up with a solution but I'm not sure it's the best way to do it. Could you please take a look at this solution and point out potential vulnerabilities or give me some hints how to get it done in a better way? Here's the solution:

1. APP1 has a link to the APP2 somewhere on the website. The link contains a login token which is generated by APP1's server, i.e. https://app2.somedomain.com/index.html?login-token=U2FsdGVkX1+S5BDg4DV0nnoq3iIEjAj6Wk48F20GjNWGZDoad8VgAW9nG4ltBV0iQNuFz428yqh6pQ6JcKMIO9c+hy9+BDGfDfqz6tuCqp4=

2. A login token is a plain text encrypted using a symmetric key algorithm such as AES and an encryption password which is known only by APP1 and APP2. It contains the following information: userId, ip address, timestamp, secret-key, ie. 00001,87.143.203.12,1399725213,secret-key

3. APP2 receives the request, decrypts the login token using the encryption password and checks the following:

   • HTTP referer - it should match to the APP1 server URL
   • IP address
   • secret-key - both apps share the same secret-key (is not the same as the encryption password) to verify that the request comes from APP1
   • whether the login token has been used or not.

4. APP2 guarantees that a login token can be used only once so it won't be possible to steal a login token and use it to access APP2 from another computer.

Answer 1

I would use an open source implementation of OAuth. Even better, you could use a 3rd party OAuth provider so that you don't have to worry about leaking your customer's credentials in the event of a compromise.

Answer 2

I agree with the recommendation to use OAuth.

For analysis of your proposal, I recommend you read the following blog post:

• If You're Typing The Letters A-E-S Into Your Code, You're Doing It Wrong, Thomas Ptacek, Matasano, July 2009.