3

I have an requirement to implement cross-domain login for two web apps (APP1 and APP2) so that a user can access APP2 once they have logged into APP1. APP2 needs to know an ID of the user who is logged into APP1. I have come up with a solution but I'm not sure it's the best way to do it. Could you please take a look at this solution and point out potential vulnerabilities or give me some hints how to get it done in a better way? Here's the solution:

  1. APP1 has a link to the APP2 somewhere on the website. The link contains a login token which is generated by APP1's server, i.e. https://app2.somedomain.com/index.html?login-token=U2FsdGVkX1+S5BDg4DV0nnoq3iIEjAj6Wk48F20GjNWGZDoad8VgAW9nG4ltBV0iQNuFz428yqh6pQ6JcKMIO9c+hy9+BDGfDfqz6tuCqp4=

  2. A login token is a plain text encrypted using a symmetric key algorithm such as AES and an encryption password which is known only by APP1 and APP2. It contains the following information: userId, ip address, timestamp, secret-key, ie. 00001,87.143.203.12,1399725213,secret-key

  3. APP2 receives the request, decrypts the login token using the encryption password and checks the following:

    • HTTP referer - it should match to the APP1 server URL
    • IP address
    • secret-key - both apps share the same secret-key (is not the same as the encryption password) to verify that the request comes from APP1
    • whether the login token has been used or not.
  4. APP2 guarantees that a login token can be used only once so it won't be possible to steal a login token and use it to access APP2 from another computer.

2 Answers 2

3

I would use an open source implementation of OAuth. Even better, you could use a 3rd party OAuth provider so that you don't have to worry about leaking your customer's credentials in the event of a compromise.

2
  • Thanks Rook. I've been thinking about OAuth but it might be a problem to get guys behind APP1 to implement OAuth. I don't want to go into details here, I was just wondering if there's any simpler solution which would be secure enough.
    – janusz
    Commented Nov 9, 2012 at 15:49
  • 3
    @janusz i would strongly advise against building your own crypto system, this is the most complex and risky thing you could do. Leave that to the cryptographers.
    – rook
    Commented Nov 9, 2012 at 16:23
0

I agree with the recommendation to use OAuth.

For analysis of your proposal, I recommend you read the following blog post:

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .