0

I have created a website A which asks username & password, there exists another closed source website B which again asks for login credentials. A user uses both these websites .I want to implement SSO a way so that if user authenticates on website B then my Website A allows user to bypass the login interface. For that will have to check a valid cookie set by website B on client browser(javascript) & decrypt (in case the cookie is encrypted). But i want to know that :-

  • Is it legal to read the cookie set by other websites (in my context) ?
  • Is it legal to decrypt cookie to check(not alter cookie data, just non malicious read ) data ?

can the owner of website B me sue the owner of website A legally ?

4

Unless "website A" and "website B" are both subdomains of the same domain, what you want to do is impossible; if they are subdomains of the same domain, the same person or organization presumably controls both. Consequently, legality is irrelevant.

3
  • I guess i was not able to convey my question, let me put it in another way.**Website A** is developed by me, & website B is security.stackexchange.com. Now if "you" login at website B , & then visit website A , then website A logs you in( javascript code checks the cookie of stackexchange ) automatically; so i want to say is that if i/my javascript check cookie stored in your browser (& the cookie was set by stack exchange); can stack exchange.com sue me to court legaly for doing so ? – Puneet S. Chauhan Nov 21 '14 at 7:26
  • 1
    @PuneetS.Chauhan What you describe is technically impossible unless website B cooperates with you. You can't read a cookie set by another website. – Philipp Nov 21 '14 at 7:57
  • 2
    The browser won't let your site's Javascript read the "security.stackexchange.com" site's cookie. If "security.stackexchange.com" is the real site you want to use, and not merely an example, you should look into implementing OpenID on your site. – Mark Nov 21 '14 at 7:58
3

Cookies are domain-dependent. You don't decide, from the server side, which cookie you read; the browser sends the stored cookies that match the name (with domain) of the target server.

If you want to share some authentication in some SSO manner, then you need both servers A and B to delegate the authentication to a common third server C. That server will do the login+password dialog, and store a cookie in the browser. Neither A nor B will ever see that cookie. Instead, they communicate directly with server C to know who is at the other end of the line. This is how OpenID works. Incidentally, that is what is used to authenticate with StackExchange sites: when they say "log in with Facebook", this means that a Facebook server will do the authentication, and the StackExchange servers won't see the password or any Facebook cookie.

Another method is to put up a front-end site D that you control, and does the authentication, and forwards all requests and responses to site A or site B, rewriting all URL within the HTML to maintain its position as a middle-man. Some vendors offer appliances that do that job (e.g. NetIQ, but they are not the only one on that market). Of course, this means that from the point of view of the end user, all the contents is served by site D, not A or B; the owner of B might sue you for unauthorized reproduction or plagiarism (whether they would win is another question).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.