Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The web tools we are developing for a client require seamless interoperability with an existing user management sytem and commerce tools (the "mainsite"). The mainsite is built and maintained by a third party. We've developed a plan to interact with this third party but are not sure our plan is secure or how it could be improved.

Regarding Cookies All web pages will be hosted on subdomains of Therefore, we should be able to read any cookies the mainsite's pages leave with the client.

User Management Customers will continue to sign in using mainsite's existing user management system. If a customer is anonymously visiting a page on our subdomain and require authentication, we will direct them to mainsite. The url we use to direct customers to sign in will include a ReturnUrl parameter so customer's can be redirected once they are authenticated.

We will check if a customer is authenticated by checking for the presence of mainsite's session tracking cookie, then reading that session tracking cookie, then making a secure request to mainsite for more information about the customer associated with that session id. We will need to know if the session is active and the customer's username.

Commerce Tools We will build an api from which mainsite can pass in a username and we would return metadata about their shopping basket items. Additional calls to the API could include requests for more information about shopping cart items.

Regarding Security We've not performed a security audit on this proposal. We suggest filtering all communication between our servers to whitelisted ip addresses. All calls between our two sides should be encrypted. We may want to consider additional security to prevent unwanted snooping into customers' shopping carts by using their account names.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.