I am currently working as system integrator for a banking company, that asked me to provide an authentication integration on a third party website on which the company would like to redirect users, but recognizing them as already authenticated.

For many reasons, they don't want the third party to be integrated on the origin domain identity provider (as a standard OAUTH2/OIDC flow).

I was thinking on this flow:

  1. Let's call origin domain a.com and target domain b.com
  2. The user authenticates on a.com and on some page he is going to have an hyperlink, something like https://a.com/go-to-b. This resource is authenticated following a.com authentication system, so the request would be a GET with a bearer token issued for a.com
  3. Behind that resource there is an a.com server-side endpoint that recognizes the user U as authenticated and issues a new token for U with an RSA256 algorithm and a private key PRI-K (different from that issued for accessing a.com/* resources)
  4. The endpoint then calls another endpoint GET https://b.com/auto-login with Authorization: Bearer PRI-K
  5. We will ask b.com domain owner to implement the GET /auto-login endpoint in this way:
    • The call is authenticated checking the bearer token with the public key related to PRI-K
    • If authentication is ok, on first access, the user is registered
    • After that, the server resource issues the internal token B-KEY for b.com and redirects with a 302 to a landing resource https://b.com/my-website setting the session cookie with B-KEY

Do you think this flow is reasonably safe? Can it be simplified in some way?

  • a.com/go-to-b will have to return redirect response to the web app in order for the web app to redirect the user to b.com/auto-login?token=urlencoded-token. As this token will have to be urlencoded, this will be visible in user's browsing history so make sure the token has an expiry and ask b.com/auto-login to not accept expired tokens.
    – defalt
    Feb 25 at 14:38
  • What if the hyperlink on a.com page points directly to the b.com resource that validates token-based login and applies redirect? I would like to avoid putting tokens in query params
    – Los Sol
    Feb 26 at 6:04
  • How does b.com receive the token?
    – defalt
    Feb 26 at 14:27
  • Isn't it possible on hyperlink click to fire a post or a get with header on b.com, that then validates the token received and then redirects?
    – Los Sol
    Feb 26 at 14:38
  • No. The browser will issue a simple GET request to the linked URL with default headers.
    – defalt
    Feb 26 at 14:44


You must log in to answer this question.

Browse other questions tagged .