Consider the following scenario: Web application is using two separate systems (they can share data/state through DB). First one is used for processing standard web stuff like HTTP requests/responses, HTML content, forms and all things related. Second is used for real-time communication like sending messages and notifications (long poll or WebSocket server).
User can be authenticated through the first system/platform and if the credentials are valid, some web page is sent back to the client. Once this page is loaded, client should be connected with the second system/platform transparently in the background.
The question is: how to authenticate user on a web page/application which consists of multiple systems/platforms on the back-end?
I can imagine it this way:
- When user is authenticated through the first system/platform, GUID token is generated and stored in a database bound to some user. This token and user ID is also sent in a response back to the client and, for example, rendered on the page in hidden fields.
- When the page is loaded and connection with the second system/platform is taking place, token and user ID from hidden fields are retrieved and sent as parameters with connection request. Back-end finds user, compares his token in the database and if they match real-time connection could be initiated.
I understand that this approach is vulnerable to sniffing for example, but I'm namely interested in the authentication procedure between two separated systems/platforms.