The question concerns the idea of transferring sessions between domains without having to log in again.

I would like to do it like this:

(user is logged in and changes the language to a language from another domain) :

  • the test_token is generated
  • test_token is used to save current session data for redis/database (max cache time 60 s - after use, entry is deleted)
  • authorization data are removed from the current session - the user is logged out of the current domain
  • Note - OIDC tokens are not revoked
  • the user is redirected to the login page in the domain that supports the given language - test_token is passed in the GET parameter
  • if the test_token is correct - the session is restored for the given domain and the user is redirected to the "dashboard"
  • if the test_token was invalid - the test_token is removed from the address and the user gets a message about unauthorized operation

I would like to know the opinion whether such a solution is acceptable from the security point of view? What can be changed or done better?

Thank you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.