I have a scenario where users logging in to one site are redirected to another domain, logged in there as well, and then redirected back to my main site (so that logging in to one allows them to log in to both). We will be including some kind of token with the login to authenticate the request. Both sites have valid SSL certificates.
My two concerns are:
1) Since redirects must use GET instead of POST, how can I send the token without it being exposed in the url?
2) The url I'm redirecting to is using HTTPS, however I know from asking this question (How to ensure my API requests are sent using SSL) that SSL can be compromised if you don't verify the certificates on both ends of the request. How can this be done for a redirect?
I'm using PHP and Laravel. I'm very much a beginner when it comes to web security, so I apologize for the basic questions. If this isn't the proper stack exchange for this question, please let me know and I'll remove it. Thanks!