Let's say I'm
main.com and my service is used by website owners
I need to verify the identity of users of client websites. (authenticate them)
My plan is implementing a backend view that's reached on client server like
clienta.com/gotomain that will authenticate users locally however they do (session auth, cookie auth, etc.) and redirect users to
main.com?token=j2j90ajsd90j2&sender=clienta with a calculated token and I will authenticate the users by token.
Token format will be
sign(userid, CLIENT_A_KEY) so signed version of userid. (I'm thinking of JWT)
what are the attack vectors to this authentication? Is there anything fundamentally insecure?