We have few in production websites say site1.dom1.com , site2.dom1.com , site3.dom1.com which are just replicas working on different server.
Now we want to extend some application on another server say app.dom1.com (Note: I don't have access to sessions stored in site1, site2 and site2) which would require authentication (if user is logged in in any of the site1/site2/site3 ), he/she should be able to access app.dom1.com
Now we don't want app1 to interact with any of the other sites.
We have thought of generating signed cookies from site1 , site2 and site3 which we can decrypt at app using same secret_key (which is used for generating the signature) and check for a particular phrases and a valid timestamp.
Now, how far is this method secure. How often should I change my secret key , and is it a good way for authentication? If it is vulnerable, how?