1

We have a database with pictures (amongst other things). We have a few apps that can connect to this database via a php webservice (send https requests to a php file to retrieve stuff from the db and write new stuff to the db).

Now a third party wants to work together with us. They have their own web portal where their users have to log in. Their users can see some basic data, and the idea is that their users that are also our users can see the pictures from our database from within their portal.

We are not going to give this third party access to our database, but we do want to expose the pictures, given that the user is logged in. So we have been brainstorming a bit and came to the conclusion that whatever way we are going to do this, it's going to be a huge potential security issue if we don't do it perfect.

We thought about creating another database and sync it every hour or so with our live database. Then we want to create another webservice, so the third party can access the data in this second database. But now there is still no way for us to make sure the user is actually logged in, we don't have access to the third party's database either, so we can't verify this.

Can anybody explain what we have to keep in mind for a project like this? Did we skip something? Is it even possible to do this 100% safe?

  • Have you already checked with your legal department if you are allowed to do this according to your privacy policy and your local privacy laws? – Philipp Dec 19 '14 at 15:06
  • @Philipp We don't have a legal department, we are not that big. One of the main reasons I'm asking this here is because I'm not sure about what all the consequences are. Nothing is final yet. – Kevin Dec 19 '14 at 15:08
  • 1
    But you do have a lawyer, don't you? When you make business with personal information and user-generated content and enter into cooperation contracts with other companies, you definitely need legal advise. – Philipp Dec 19 '14 at 15:30
  • @Philipp We might, I don't know about that, I'm just the programming goblin :D – Kevin Dec 19 '14 at 16:27
2

There is a framework that exists specifically to enable this sort of scenario. It is called OAuth 2.0. What you want to do is to have an API that exposes the resource owners' (your users) resources (their pictures) for the client (the third party) to consume with the permission of the individual resource owners.

So, in this model, you become an OAuth 2.0 provider, and the third party implements an OAuth client. Then, the users who are user of both servers can authorize the client to access their pictures, and the third party will be given an access token that will allow them to retrieve the pictures from your API for the users who have granted them said access.

I don't know that the second database serves any purpose. Since you're going to be exposing access via a service rather than granting direct access to the database in any case, the second copy of the database simply sounds like unnecessary additional complexity to me.

1

First of all: Have you already checked with your legal department or a qualified lawyer if you are even allowed to do this according to your privacy policy and your local privacy laws? When you haven't, you must do this first.

The main security problem is to find out which of their users are also your users. This is not as easy as it seems, because "Kevin" on SiteA and "Kevin" on SiteB might be completely different people. You could try to compare other personal information with each other, but this is 1. unreliable and 2. would be quite a privacy violation.

When the users acquire the images from a client-sided javascript via a webservice which runs on your domain, you could recognize them by their login cookies. But that only works in a completely client-sided context. When their server is supposed to query the pictures, this won't work.

An alternative would be to allow users on their website to manually link their accounts to those on your website. When the users are on SiteA, they click on "Allow SiteA to import my images from SiteB"¹. When they do, SiteA connects to SiteB to request a one-time token for that user. Then the user gets a link with that token which sends them to SiteB. When they click on that link they need to log in (when they haven't got a login cookie yet) and get a message "Do you want to share your images with your account NAME on SiteA?"¹ When they confirm, you have both established a link between the two accounts and also obtained the users consent to share the images. You can now let SiteA request any images for that user.

¹) Check the exact wording for these prompts with your legal department / lawyer to make sure you get all the users consent you need according to your local laws and regulations. Copyright law is also an issue in this case because you copy user-generated content to a 3rd party.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.