I have a B2B web app (and API) called XYZ
. I have business customer ABC
(and DEF
, GHK
, etc.), each of which have their own web app with their own distinct users. When a new user of ABC
(or DEF
, etc.) registers, they also create an entry in my web app XYZ
. I'd like to provide a UI form to the end users of ABC
(in their respective web apps, not mine) that lets them view or edit their own custom XYZ
data.
My proposed solution is:
User
J
of customerABC
requests to view (and later submit with changes) my UI formCustomer
ABC
validates userJ
is authenticated and authorized to view the form, how ever they choose to do thatVia server-to-server communication, customer
ABC
requests a single-use read token and single-use write token (with a minimum length, non-incrementing, and an expiration date) for that userI validate the request (using a shared secret between
ABC
andXYZ
perhaps), and send back the two access tokensThe form uses the read token to request the data from my
XYZ
server, and is marked as usedIf user
J
does a POST with the form, they use the write token
Everything is done over TLS. Is this a valid, secure approach (in theory)? Is there a better way (using third-party cookies perhaps)?