I'm owning web app "A" and want to work with a third party service "X". User "Alice" has accounts on both platforms. App A knows the user ID of alice on X, but X doesn't care about Alice being on A or not.

I want to provide service X with an easy to implement mechanism that would allow Alice to just click a link when logged in at X and - when not signed in already - be signed in to her account on app A, given that A knows Alice already of course.

For the most part I trust service X in this scenario. So I was thinking about giving them a secret key with which they can generate a short-lived JWT token. App A can just check that token and log Alice into her account.

Are there problems with this idea or obvious alternatives? I thought about OAuth, but that would mean service X needs to become an OAuth provider, which they are not or should not required to become. I also don't need to access any of Alice's data on X or check her name or anything.


1 Answer 1


JWT is a reasonable way to do this, as is OpenID or OAuth (With OAuth, what you are doing is creating a provider that will verify the userid). Try to use standard libraries as much as possible - it is really easy to get Tokens wrong (enabling replay attacks and similar). As well, all communications should be encrypted (TLS).

  • Saw this yesterday - haven't read it for a decade or more, but it still holds up. A reminder of the sort of things you need to think of with token/ticket systems - web.mit.edu/kerberos/dialogue.html
    – crovers
    Commented Jul 21, 2016 at 16:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .