The question concerns the idea of transferring sessions between domains without having to log in again.
I would like to do it like this:
(user is logged in and changes the language to a language from another domain) :
- the test_token is generated
- test_token is used to save current session data for redis/database (max cache time 60 s - after use, entry is deleted)
- authorization data are removed from the current session - the user is logged out of the current domain
- Note - OIDC tokens are not revoked
- the user is redirected to the login page in the domain that supports the given language - test_token is passed in the GET parameter
- if the test_token is correct - the session is restored for the given domain and the user is redirected to the "dashboard"
- if the test_token was invalid - the test_token is removed from the address and the user gets a message about unauthorized operation
I would like to know the opinion whether such a solution is acceptable from the security point of view? What can be changed or done better?