I now have two websites - site A and B, both with SSL-certificate, and they have exact same users. So when a user log into site A and click the link to site B, I want to make him auto log in to site B.
It will be easy if I just use regular POST and GET to pass the user id form site A to site B(more specifically I am using PHP POST and GET). But I wonder will it be done under protect of SSL automatically or I need to do something more complicate to ensure the security?
A user is "logged on" site A because server A considers the requests from that user to be "linked beyond reasonable doubt" with the user identity. There are several methods by which such a result can be obtained; but usually, some authentication protocol was played (user shows his password) and then some sort of link is maintained, so that for each subsequent request, the server knows that it is "from the same guy as previously".
There are several methods to maintain this link. Main ones are the following:
Each request from the user's browser is a GET or POST which includes as extra (hidden) parameter some authentication token. The token was created by the server when the authentication protocol was executed, and each page sent by the server contains it.
An authentication token was sent by the server to the client, to be sent back to the server with each request, as a cookie.
The server keeps track of the client through the SSL session (when the client reconnects to the server, both client and server agree to reuse the cryptographic elements from a previous handshake, because they both remember the corresponding keys).
The third method is specific to SSL; otherwise, the fact that you use HTTP or HTTPS is irrelevant (except that with plain HTTP, the result would not be secure, but that's another debate).
HTTP cookies are attached to a site name. So if authentication to site A works that way, then the browser will not send the cookie to site B, and the authentication will not be automatically transported from site A to site B.
The first method, though, may work. It "suffices" that authentication tokens created by site A be recognized by site B. But, of course, you don't want other people to be able to produce "valid tokens" out of the blue. So this entails either some form of communication between servers A and B (A telling to B: "hey, I just created this token which authenticates that user), or cryptography (tokens created by A must then contain the user's name and some form of signature or MAC from server A, verifiable by server B).
