Two websites with different CMS, user should type login & password on one website and needs to be logged in second website automatically. Now i have this method, it works but i want to know - is it secure enough?

1st site:

  1. User successfully logging in with his login & password
  2. username encrypted with php mcrypt (MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CBC, )
  3. sha1 hash generated from encrypted username, timestamp, secret key
  4. encrypted username, hash and expiration time inserted into database
  5. redirect to second website with hash parameter (GET method)

2nd site:

  1. get data from request and try to find row in database with this hash
  2. if row found - get row data (encrypted username, hash, time) and delete row from db
  3. check if user logged in few seconds ago
  4. create new hash, compare it with hash in url and hash in database (not necessary as we already found hash in database but...)
  5. if no errors found - login user by decrypted username
  • so the two websites share a database, but are hosted on different servers and domains? – tim Apr 9 '15 at 9:07
  • No, both of them are hosted on the same server. Second website located in subdirectory. Both of sites have access to additional database. – user72077 Apr 9 '15 at 10:11
  • 2
    Looks like you just need to set a cookie for both sites. – Erbureth says Reinstate Monica Apr 9 '15 at 10:22
  • If they share common infrastructure, can they not share a common authentication method? That would be more secure. – Julian Knight Apr 9 '15 at 16:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy