I find myself in a situation where I need to hand a user off from a mobile application into a web application. The mobile application is using WebAPI on the backend with OAUTH 2. The web application on the other hand is MVC using cookies.
I'm not able to change the web application in any meaningful way, but I have a requirement to not have the user to log into the website after they've already logged into the app.
So my thinking is add an entry point route to MVC, that doesn't require auth and takes as parameters the token used on the api, and the url the user desires. The controller would authenticate the token, issue the cookie and the redirect the user to where they want to go.
This would be an invisible hand-over controller. It makes a kind of sense and it should be easy to do, but I feel uncomfortable logging the user into the site without going through the typical route.
Are there potential vulnerabilities in this approach?