Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My company owns a domain , and subsdiary is on redirects their users to for accounts registrations. Post successfull registration , logins that user ( User doesnt get to know this), creates a token and needs to pass that token to so that shows that user logged in.

What should be the correct way to pass this information to as we cannot write cookie for them.

I was thinking of encrypting the token , and and decide the encyption to use. But are there any other better approaches to deal this issue ?

share|improve this question

You can have create a random N-bit token used as a key in a keystore. Then sends to the user a link to containing this token in the clear. The user accesses with that token, and can contact "privately" and retrieve data associated to it, whereupon may invalidate the token so it can't be reused.

Given the short round-trip time (the links are all redirects which should be handled automatically by the user's browser), could be justified in refusing token requests for tokens older than, say, 30 seconds:

user  --> "log me in" --> user  "Go to$RANDOM1" { cookie }
user  --> "log me in"
(login procedure) --> user  "Go to$RANDOM2" [START "A" TIMER]
user  --> "my token is $RANDOM2 (and my cookie is $RANDOM1)" --> "What about $RANDOM2:$RANDOM1?" [STOP "A" TIMER]

Now has stored $RANDOM1 upon the first request, recognizes $RANDOM2 as of its own making, the timestamp is valid, so on the link A-B can flow all sort of secret information unbeknownst to the user.

share|improve this answer

Sounds like you could use something like the OAuth authorization framework. The OAuth authorization framework enables third-party applications to obtain limited access to an HTTP service and there are many libraries available so you dont really need to implement everything yourself.


share|improve this answer
Or SAML (apparantly 'or SAML' is too srort, so here is a bunch of garbage text lessening rather than increasing the value of my comment) – atk Dec 15 '13 at 14:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.