Given two companies managing two separate websites, the client wants the user to be able to log in to one website, and then click a link to navigate to a certain part of the second website. The client wants to eliminate the need to log in a second time upon arriving on the second website.
I'm thinking the solution is
- Rather than linking directly to the second website, link to a redirect page within the first site.
- The redirect page would generate a random string, and notify the second website what the random string is, and which user ID and IP address it is for.
- The user would be redirected to the second website with the random string included in the URL.
- The second website would check the random string + IP + date/time.
- Once validated, the second website would initialize a login session giving the user appropriate access.
Caveats I am aware of are
- The second website's security is limited to that of the first website.
- If the user logs out of one site, they would not automatically be logged out of the other one.
So my question is
- Is this solution a good one, would it be secure if properly implemented?
- Is there another obvious/better solution I should be reviewing?
- Please let me know if there are any other caveats I should know of, or things to watch out for during implementation.