I have 2 portals(both are under my control & domain names are different)
In 1st portal, there is a link on click of which User can directly get logged into 2nd portal.
Link which will be hit in 1st portal to log into 2nd portal looks like below(Its a GET)
This URL has problems like it can be cached and bookmarked. Also, if a User doesn't get authenticated to my 1st Portal, but hits above URL directly then also he can login (against my wish).
So, am thinking of putting a check using Referer. If source URL is so and so then only allow to login.
How strong is using Referer compared to validating checksum between source and target? Referer is a client-controlled value and can thus be spoofed to something entirely different or even removed. But, even a checksum value can be studied and spoofed.