1

I have a scenario where users logging in to one site are redirected to another domain, logged in there as well, and then redirected back to my main site (so that logging in to one allows them to log in to both). We will be including some kind of token with the login to authenticate the request. Both sites have valid SSL certificates.

My two concerns are:

1) Since redirects must use GET instead of POST, how can I send the token without it being exposed in the url?

2) The url I'm redirecting to is using HTTPS, however I know from asking this question (How to ensure my API requests are sent using SSL) that SSL can be compromised if you don't verify the certificates on both ends of the request. How can this be done for a redirect?

I'm using PHP and Laravel. I'm very much a beginner when it comes to web security, so I apologize for the basic questions. If this isn't the proper stack exchange for this question, please let me know and I'll remove it. Thanks!

Improve this question
1

1 Answer 1

Reset to default
2

Since redirects must use GET instead of POST, how can I send the token without it being exposed in the url?

Redirects can actually use POST (redirect code 307) but since POST is considered a state-changing operation contrary to GET it should not just be repeated without asking the user. Best would be if it does not matter when the token gets visible, i.e. it can be encrypted by the origin site and decrypted by the target side. This can be done for example with public key cryptography if the origin knows the public key of the target.

however I know ... that SSL can be compromised if you don't verify the certificates on both ends of the request.

This statement is not true and it is not claimed in the question your reference. For securing a SSL connection against man in the middle attacks it is only needed that the server authenticates itself with a certificate and the client properly validates this. Client certificates are only needed if the server likes to authenticate the client but are not needed for protection against a man in the middle.

There is no special thing to watch out with redirects and HTTPS in your case: the client simply does TLS to both sites and validates their certificates.

Improve this answer
4
  • Thanks for the response, it seems I misunderstood how the certificate verification works. Let me make sure I've got it right this time, when you're securing the SSL connection, the server receiving the request authenticates itself using the certificate. This is done to confirm the identity of the server, basically to make sure that the request went to the right server and not a server trying to intercept the request. Is that correct?
    – Christian
    Nov 15, 2016 at 19:46
  • 1
    @Christian: Authentication is done before the request is even send. Inside the SSL/TLS handshake the server securely authenticates to the client with the certificate so that the client could detect a possible man in the middle attack (i.e. authentication failed). Only if this is successful the client will then send the request inside the encrypted connection.
    – Steffen Ullrich
    Nov 15, 2016 at 19:55
  • Okay thanks, I really appreciate the help. So just to be clear, the certificate will be authenticated automatically? There's nothing extra to do on my end, such as specify what certificates are trusted?
    – Christian
    Nov 15, 2016 at 20:04
  • 1
    @Christian: within a normal browser the browser does all the validation for you. When writing your own TLS enabled applications things might be different.
    – Steffen Ullrich
    Nov 15, 2016 at 20:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .