We're implementing a web application (US) that needs to exchange sensitive information with a third-party web application (THEM). The way we'd like it to work is that an end user clicks a hyperlink, navigates to the third-party web application and magically the sensitive information is available to the third-party web application.
As you'd expect, we'd rather not send that sensitive information along with the url the user clicked. We do not control the third-party web application, but we can impose how they integrate with our web application. We'd like to keep this as simple as possible from a technology perspective (low bar to entry so to speak). Obviously we have full control over our own web application.
We were thinking along the lines of having some sort of one-time usable, randomly generated, restricted in time, access token.
- We assume the end-user has been identified/authenticated.
- The end-user clicks a link which obtains an access token from our own web application. Since all sensitive information is available server side, there's no need to share it with the end-user's browser. We store the access token and its expiry date and time along with the sensitive information. The sensitive information cannot be derived from the access token itself. Our web application redirects the end-user's browser to the third-party web application with the access token in the redirection url.
- The third-party web application receives the incoming request and uses the access token to obtain the sensitive information by issuing a server side request for the information back to our web application. Our web-application returns the sensitive information and now the third-party web application can use said information. Obviously we'll handle access token removal, expiration, etc.
Apart from someone being able to obtain the access token in transit and having to secure the access token storage as well as the server-side communication between our application and the third-party application, do you see any other security holes? Instead of rolling our own is there any widely adopted standard we could use instead?