Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Scenario :

  1. Application redirects its users to application for Account Creation.
  2. creates the account, and redirects the user back to with the encrypted Username (+ Timestamp).
  3. reads it and displays on its form.

Constraints :

  1. Cant use it as GET parameter since no logging needs to be done.

  2. Cant set it in cookie as already uses plenty of cookies.

  3. HTTP Post form submission to is not possible due to restrictions of the internal development framework.

Can anyone please suggest what should be the ideal approach to send the Encrypted username (+ Timestamp) back to

share|improve this question
Need more details, what server platform are you using? If it is IIS, have you considered having a common application pool handle both application folders? Are the subdomains on different machines or just different sites? Are they even on different sites? – AJ Henderson Jan 16 '13 at 17:02
This also may be more of a server fault or web developers question since this is more of a "how to move data between sites" and the fact it is encrypted is pretty much secondary. – AJ Henderson Jan 16 '13 at 17:03
AJ : They are all together different setup ( Our webserver cant talk to their webserver). I dont see any option to move this thread to Server fault, care to explain ? – Novice User Jan 16 '13 at 17:10
AJ : We are using Apache at webserver level and prioprietory framework at App Servers. – Novice User Jan 16 '13 at 17:12
up vote 3 down vote accepted

First and foremost do not write your own protocol for this! Other people have this exact same need and they use oAuth!

If you just need to know that they are connected an oAuth 2-legged is perfect. If you need to share more information about this user then use 3-legged oAuth.

share|improve this answer
Wouldn't OAuth depend on POSTing to a? Or is it that a can POST to B and get the response back? I'm not that familiar with the actual mechanics of OAuth at that level. – AJ Henderson Jan 16 '13 at 17:16
@AJ Henderson a subdomain can initiate an oAuth 2-leg request. If you don't know why, you need to read about oAuth, i don't know why you would suggest anything else. – rook Jan 16 '13 at 17:28
yeah, I just couldn't remember the exact mechanics of OAuth and if that ran afowl of any of his (somewhat odd) requirements. I did mention OAuth in my answer as it's the ideal if their environment will allow it. It sounds like they want the user to interact with B which means B has to communicate back to A somehow. I thought that was through a post back to A. – AJ Henderson Jan 16 '13 at 17:34
@Rook : This indeed looks like a good approach. Thanks ! – Novice User Jan 16 '13 at 17:50
@Rook - err, nm, I just think I figured it out. A just produces a token and asks B to authorize the token for access. B then handles producing the account with the user and grants the access, then when the user returns to A, A can use the token they have on file to request the account from B. Is that correct? – AJ Henderson Jan 16 '13 at 18:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.