0

I have this scenario:

  • Webserver domain A. Generates sensitive information when a request from a browser is received but this information is not disclosed to the browser.
  • Webserver domain B. Processes the information generated by webserver A on receiving a petition from the very same browser which contacted webserver A.

Communication between the browser and webservers is secured (https). Webservers can communicate directly and securely with each other

How could I implement this scheme in a simple and secure way?

Thanks

  • after the browser send request to A, does it have to receive the response from the server B ? your requirements need more elaboration. – elsadek Apr 24 '15 at 21:59
0

Without more data I can only hint at some ideas.

I see two basic strategies:

  1. Encryption: Webserver B has a public/private key. Webserver a knows B's public key. When the client makes the request to A, A returns the data encrypted with B's public key. The browser then passes the information to B for processing.
  2. Side channel: When the browser contacts A, a token is returned. The browser passes the token to B. B then contacts A directly, likely authenticating to A, and passes A the token. A, upon seeing the token and that the current user is B, sends the data directly to B.

Hope this helps. Add more information to your question if you want more specifics.

  • Thanks Neil. I think side channel strategy is more suitable for my case. I wonder what needs to be added to avoid potential attacks when passing the token through the browser (replaying, xss, etc) – securityCurious Apr 25 '15 at 19:45
  • On first thought I think the token has the same security concerns that a session token would have. So you need to worry about standard web app security like XSS. You'll also need to make sure the token can't be forged, has a timeout, etc... – Neil Smithline Apr 25 '15 at 21:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.