I'm trying to build a single sign on system that connects app A to B and B to A. Unfortunately, the option to use OpenID/OAuth/SAML is not possible right now, so I am building a basic solution myself, here's how it goes:
- User logs in to App A
- User clicks on "Go to App B" link
- Server for App A generates a JWT token containing the user ID and expiry date, saves a hashed output of this string in a shared location (like Redis) and redirects to App B's endpoint along with the token
- App B hashes the token it received and checks if it matches the hash that's in the database. If it matches, then it checks to see if the token has expired and rejects/accepts the request based on the evaluation.
- App B makes a call back to App A along with the token and a "SUCESS" message.
- App A again hashes the token and checks in the database to see if the two hashes match. If they do, then App A issues a temporary authentication token to the client.
- For all future requests to App B, App A passes along the temporary token (which App B validates against a secret key) and App B grants the request (if not expired and rejects if expired)
This is the approach that has been implemented and functional, but I wanted to know how secure is the logic. Do you see any obvious security concerns with this implementation?