I have an requirement to implement cross-domain login for two web apps (APP1 and APP2) so that a user can access APP2 once they have logged into APP1. APP2 needs to know an ID of the user who is logged into APP1. I have come up with a solution but I'm not sure it's the best way to do it. Could you please take a look at this solution and point out potential vulnerabilities or give me some hints how to get it done in a better way? Here's the solution:

  1. APP1 has a link to the APP2 somewhere on the website. The link contains a login token which is generated by APP1's server, i.e. https://app2.somedomain.com/index.html?login-token=U2FsdGVkX1+S5BDg4DV0nnoq3iIEjAj6Wk48F20GjNWGZDoad8VgAW9nG4ltBV0iQNuFz428yqh6pQ6JcKMIO9c+hy9+BDGfDfqz6tuCqp4=

  2. A login token is a plain text encrypted using a symmetric key algorithm such as AES and an encryption password which is known only by APP1 and APP2. It contains the following information: userId, ip address, timestamp, secret-key, ie. 00001,,1399725213,secret-key

  3. APP2 receives the request, decrypts the login token using the encryption password and checks the following:

    • HTTP referer - it should match to the APP1 server URL
    • IP address
    • secret-key - both apps share the same secret-key (is not the same as the encryption password) to verify that the request comes from APP1
    • whether the login token has been used or not.
  4. APP2 guarantees that a login token can be used only once so it won't be possible to steal a login token and use it to access APP2 from another computer.


I would use an open source implementation of OAuth. Even better, you could use a 3rd party OAuth provider so that you don't have to worry about leaking your customer's credentials in the event of a compromise.

  • Thanks Rook. I've been thinking about OAuth but it might be a problem to get guys behind APP1 to implement OAuth. I don't want to go into details here, I was just wondering if there's any simpler solution which would be secure enough.
    – janusz
    Nov 9 '12 at 15:49
  • 3
    @janusz i would strongly advise against building your own crypto system, this is the most complex and risky thing you could do. Leave that to the cryptographers.
    – rook
    Nov 9 '12 at 16:23

I agree with the recommendation to use OAuth.

For analysis of your proposal, I recommend you read the following blog post:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.