Proxied server requests + forwarding authentication info in a secure fashion

Question

We are using PassportJS with a couple of Node.js servers - Passport is just a library that is popular for Node.js server authentication - but we have some questions about how to use Passport with "proxy" requests. My main question is how do we (and should we at all) forward the headers and cookies in the original request to the proxied request?

For example - we make a browser-client request to server A which in turn makes a request to server B - we want the same client to be authenticated in the same way on both servers. Currently if the web client makes a request directly to both servers, the client is authenticated, but if the client authenticates with A and then A sends a completely new request to server B, then of course, that second request contains none of the auth info that is needed to authenticate the client on server B.

Considering we own both servers A and B, should we just include the headers and cookies from the original request in our request from server A to B?

is this considered a good practice? Any info would be helpful, thanks

I asked a similar question of Jared Hannson of PassportJS fame:

https://github.com/jaredhanson/passport-github/issues/52

Given a good answer here, I might copy it over there

Answer 1

This question is really one specific to your business needs.

In general what you have proposed is commonly done. You are always faced with the challenge of balancing usability with security. Take Yahoo or Google for example. They authenticate you once then store information in one (or more) cookies that are passed to other sites with which they integrate. Then look at the Yahoo wallet (when it was the prime thing for payment on the internet in the late 1990s and early 2000s), it required yet another authentication with different credentials. They thought, and I agree, that this piece of their infrastructure needed an additional layer that was from the rest. That is, they did not trust the main site credentials.

Note neither Google nor Yahoo pass the user passwords around their sites or store them directly in cookies or databases. Rather, they establish a verification system. For example the hash that becomes the cookie can contain tidbits of information identifying the browser client, a fraction of the source address, authorization tokens, ++++. There are many sufficient schemes.

So, does the security of your site need the user to perform authentication for both servers A and B? Only you can answer that. If the answer is no, then you should trust the result of the authentication from server A. If your answer is yes, then authenticate at both places.