Restrict website access

Question

I want website (A) to only work if a visitor came by clicking a link from a specific other website (B).

Initially I thought of using the document.referrer from website A to check whether website B is the source, but apparently it can be faked easily.

How could I achieve this?

More info:

• Assume that website B code is nearly untouchable, and if possible all changes have to be made in website A,

• Website A runs on nodejs server.

Answer 1

This is sort of how JA-SIG CAS (enterprise SSO) works. To apply that architecture to your instance, setup the following on WebsiteB:

1. Have WebsiteB generate a unique token in the link such as in the query string and make sure it uses SSL. Store the token information in a database (or similar method). Be sure to include a timestamp for when it was issued so time restrictions can be enforced.

   <a href="https://websiteA/?MyTokenForWebsiteB=unique_token_value>Specific Link</a>

2. Setup a web service on WebsiteB, which is only accessible from WebsiteA via SSL, to validate the authenticity of tokens issued. Include logic to not allow tokens older then some predetermined limit (5 minutes?).

When users click on the link in WebsiteB and arrive at WebsiteA, perform the following on WebsiteA.

1. Check that unique token exists and there's a value.
2. Validate token against web service on WebsiteB

Answer 2

If website A and B are linked internally, you could just transport the session information, so the session key can be used to automatically login to website B - doing this without website A and B communicating internally somehow would very very difficult to secure.

Basically you need a method of A telling B which client session codes are valid, without relying on the client transmitting this information.

---

Of course it is possible to do it this way using PKI, but I imagine that's a little overcomplicated for you situation. In any case, this solution would basically be implemented as follows:

• Client connects an logs into website A
• Website A creates session cookie and signs it with website B's public key
• Website A redirects client to website B along with signed cookie
• Client goes to website B, presents signed session cookie
• Website B reads session cookie, verifies it with website B private key
• Client is now logged into website B

Bear in mind this whole process could still suffer from a number of attacks if any of these connections are not secured via SSL/TLS.

Answer 3

If you can't perform any change to website A, you cannot achieve what you need...

However, if you can change website a or add a new page, module, method or any server-side thing, Digital Signature algorithms are designed to do similar works. An example is in the following...

• In site A, encrypt a time stamp first with private key of A and then encrypt it again with public key of B.
• Send it to B with query string or http header.
• Decrypt it first with private key of B and then validate it with public key of A.
• If the decrypted value is meaningful and is not from the past(for precise scenarios, you need to store received time stamps in B), you can believe that request is coming from A.

All you need to do is to find out how to implement digital signature algorithms in your technology stack(Node.js, J2EE, .NET or what ever...)