How is secure passing a Bearer Token from two web application using query string?

Question

I have two web applications (prototype) hosted on two sub-domains, example:

1) A CMS (done in PHP) at cms.mydomain.com.

2) A SPA - Singe page web application (done in JavaScript) at spa.mydomain.com.

My User case:

User can access CMS app and authenticate using Username and Password.

After authentication is successfully completed a web page with some items is presented on CMS app.

User can select an item and than open on a new window with SPA application.

At the moment, after authentication is completed in CMS app a Bearer Token is created, we are passing the TOKEN to the SPA app as query string in order to authenticate the User.

SPA app JavaScript retrieves the query string and other additional parameters and execute API call in order to function.

Notes:

• We are using HTTPS on both applications.
• SPA application can be accessed only after authentication in CMS.
• SPA application which receive the token is on an .HTML file and API calls are made using JS only.
• Bearer Token has validity of 14 days.
• The token give full access to SPA application.
• The token could be passed from CMD to SPA using also JS.
• Tokens are generated by a third application api.mysite.com.

I am aware that TOKEN in query strings could be unsecured because:

• URLs with their query strings parameters are saved in web server log, and access to them could compromise security.

• Third party application like Google Analytic could store in their report such URLs and query string.

I would like to know your opinion on:

• What could be a safe way to pass the token from CMS to APP without using query string?
• I am thinking if Window.postMessage() could be used in CMS to send the token as message to SPA. Do you see any security issue with this approach?
• What other risk I could encounter if using query strings (I need to convince my team query string is not a good approach - if true :) )?
• Could you point me out some additional resource or guidelines?

Thanks for your time.

Answer 1

You could perhaps create a one-time access token to the SPA rather than sending the original bearer token as the query string.

This token could then be sent to the API, decoded and used to create the real auth token, but would have the advantage of only being valid once. Now you no longer need to worry about server logs, GA, etc. I suppose it's a form of redirection to alleviate those concerns.