Menu
So. I have domain A.com, of which the user authentication is done at domain B.com. Currently I have it set so that the login form is posted to B.com, which (if succesfull) sets the session cookie and fires redirect to A.com/loggedin. However, as the form is posted to the B.com and the cookie is set to that domain, when I do JSON request from A.com the session cookie isn't available an I have no idea if they logged in or not. The question then becomes, how to solve the issue?
I've been mulling over a solution wherein I would add a token to the redirect uri, which then could be used for one time authenticated session creation with A.com (the browser could use that token to auth the session with B.com, so that the cookie would be set to A.com and would be available on JSON requests. After that the token would be invalidated ofc).
However, I'm not sure how secure this solution would be? Or is there an other more secure solution?
506
Cross-domain authentication is a common approach in identity management that authenticates users for sites that run on different domains. ReachFive handles this even for browsers that block third-party cookies. Cross-domain authentication is much more streamlined when using SSO.
The SSO domain authenticates the credentials, validates the user, and generates a token. The user is sent back to the original site, and the embedded token acts as proof that they've been authenticated. This grants them access to associated apps and sites that share the central SSO domain.
Embedded Login allows your users to log directly into your application and transmit their credentials to the Auth0 server for authentication.
Your current solution looks good to me and can be used in this scenario. But for your security concerns, instead of providing a plain token you may want encrypt it with some good encryption method and based on that you can configure your servers to encrypt and decrypt the authentication token before using it. The only thing is that you need to choose the best algorithm for your case.
Other than this solution you can give a think to session management tools. Session Migration, Session Replication and Session Sharing are the options that I can think of.
Here is Link for a solution provided by Oracle for session sharing, which I think can help in your case.
87
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
