I have a microservice app.
hub.example.com handles authentication. When a users logs in, I need to set a cookie on
learn.example.com What is a secure way to set this? I'm aware of a few approaches:
hubsets the cookie on
example.comThis works, but the cookie propagates to other subdomains. Also a risky subdomain like
labcould set the cookie.
setCookiecontroller. Hub returns a redirect (or possibly a different mechanism) to
learn/setCookie?session=123This works, but any domain (even
evil.com) can use the controller.
setCookiecontroller could verify
Originand only allow
hub. I'm not quite sure what the usability and security consequences of this are.
learndirect with server-to-server authentication and get's a one-time token.
hubthen sends a redirect to the user's browser to
learn/setCookie?token=token(thanks to Fire Quacker)
Any suggestions about this would be most appreciated.