I have 2 websites: a.com and b.com
To avoid using SAML for Single-Sign-On and making things complicated, I've taken this approach:
a.com is the identity provider. All users will be asked to sign in on a.com
b.com will receive information from a.com on the session and sign them in on b.com. A part of this is b.com passing a random 128 character long "token" in the URL parameters to a.com like so:
If the user is not signed in, they are asked on a.com to provide their credientals. Once they are signed in or if they already were signed in, a.com then sends the token back to b.com with an HMAC SHA3-256 signature attached containing the API key:
sig variable is sent from a.com and contains several variables including the API key (secret) that only a.com and b.com know. The signature has the following:
- The random token 1st sent from b.com (
- The UUID of the user that's being signed in (
- The current time (not sent in URL params, verified server side only)
- The users IP address (also not sent in params; server side)
- The browsers user agent (not sent in params)
- Finally as the HMAC key, the API key that only a.com and b.com is used.
If for some reason the API key that a.com & b.com use was exposed, anyone would be able to generate the
sigvariable hash and would be able to spoof who they are to b.com as they could easily find the token in the params, set the UUID to whatever they want, and the signature would match.
My question is: Is it safe to pass the signature in the URL parameters and does this make it possible for someone to figure out the API key? If this approach is insecure, what would you recommend?