Illustration : mainsite.com and contentsite.com both are being developed for same company by two teams. we will have login etc at mainsite.com contentsite.com will have some content that is not available for users who have not non logged. But login will be via mainsite.com What is the best way to implement this? Some users might be on http, we want them to be redirected back the http page they were on, if they click login. Besides that we need contentsite.com to know that a user had logged in and what ther id is.
There will be a seperate on register and on-profile change job that shares information from mainsite to contentsite.com
So the question is : is encrypted user name enough (after login to tell content site that user has logged in? add random salt so it cant be spoofed?) 2. need webservice so contentsite can cross check login?
We are considering :
- Redirection on login so we touch the 2nd site and allow it to place http and https cookies. Is this what google does (but only https) for youtube and other google sites? Or a combination of web services domain to domain calls in the background? Do we need API calls to stop man in the middle or is initial SSL enough? Finally we want to be able users to use most of the website in http or https besides the checkout, login and profile pages.
- oauth or auth0.com or other scheme, not sure if we need this as we are already using a world class spring security impl built by a big co and just want to share our login user id with other domain that is our own
Looked at a few question about the same thing like this node js question but they did not seem to fit exactly. Is there a standard we have missed?
We are using spring security for the main store. The content site will have no data base but we will share some profile information via separate non web channels (on sign up and profile change api calls).
For login the store website has SSL pages ready, that redirect you back to the original page (http or https).