Scenario: I'm logged in some (java - swing) application. The authentication is typical: login and password checked by server (J2EE) on client application start, after that normal work in app including many requests/responses:
Client <------------------> Server1
Now, I want to do something like this: user clicks on some button in application and after that, the app opens default internet browser with some url pointing to other www server (Server2) but with "user context/session" for futher processing (sending request to Server1), like this:
Client -----> Browser -----> Server2 -----> Server1
The page should "catch" present client user session ID (kind of single sign-on). As far as I know, it's not able to start browser with created cookie "just before start", so idea is:
- Opening browser with /Server2ServiceUrl/JSESSIONID.
- Browser goes to Server2ServiceUrl.
- The user is doing some operations on page (filling form) and clicking for example "save button" on this page.
- The result is requested to Server2.
- Server2 creates session cookie (JSESSIONID) based on JSESSIONID in its initial url and sends request to Server1 with session cookie (in "Cookie" HTTP Header) so Server1 knows what user sends request.
Of course it is far away to be secure. One of the big issues is session ID visible all the time in browser address bar. One of ideas to increase security a little bit is:
- Browser goes to Server2Url, but not to the service, only to some url which:
- will create browser session cookie based on JSESSIONID in initial url
- will send redirect command to browser.
- Browser create session cookie and redirects to service (Server2ServiceUrl). Because of that the session ID will be visible in browser address bar only till redirect.
But still I feel that this concept should be more secure. What should I do then? Maybe is some standard technique to solve this problem?