How to transfer login information and automatically log to another website, when user click on link?

Question

I have hosted 2 website, these two website use same database to populate data. eg: users - table has user login details, both website users can access their login via this table.

Now I want to do this:

Before access both website they need to login.

My "Website A" has link call "Read More" when user click on it, that user should be redirect to "Website B". Now I want to skip "Login" process from B website(because that user already loged in A). How to do that,

I got mind this option, but less security:

1. A website read more link as

B_website/?username=abc&password=123&page=12

I guess this is not good option, what are the ways i can do this with keep high security?

Answer 1

No no no - do not pass the username + password in plain text in the URL!

I would recommend taking a look at how you know that the user is logged in on site A. Is there some sort of flag in your database marking this user as logged in? Could site B somehow be aware of this flag? Since your two sites share a database, this would definitely be possible.

Consider the following scenario:

1. User logs into site A.
   • A unique "login token" is generated, saved in your database and also sent to the client.
2. User arrives at site B.
   • The user sends the "login token" they previously recieved to the server.

If the login token sent by the user matches the record in the database you can skip the authentication phase and mark that user as logged into site B.

Answer 2

Server sessions are basically hand-designed to solve this problem. If your websites already access the same database you can utilize a PHP built-in feature, which is to create a session_handler that opens a database connection and stores your session in a database table.

I am personally a big fan of Symfony's HttpFoundation (see below). However, you can do this natively without relying on any outside libraries.

Start by creating a table (this is a MySQL table, but it should be pretty easy to adapt this:

CREATE TABLE sessions (
    sess_id VARBINARY(128) NOT NULL,
    data BLOB NOT NULL,
    sess_expires int(11) UNSIGNED NOT NULL
) COLLATE utf8_bin, Engine=InnoDB;
  

Next, create a session handler session_set_save_handler(), as per PHP Documentation. Create callable functions, and assign each function like so:

Open

Create the database connection.

Close

Closes the database connection.

Read

Retrieves session from the database.

Write

Stores session in the database.

Destroy

Destroys the session.

Clean

Cleans old session data based on your system settings.

Here are some different implementations. They all should work so whichever one you find most attractive can be used as a base. Once you settle on your style, you simply copy the code in each of your client sites and it will pull a shared session!

A tutorial by Chris Shiflett is probably the most basic and accessible if you are unfamiliar with much of how this sort of thing would work.

DevShed has an object oriented approach which can probably be copied and pasted for the most part. They also do a good job explaining how to use the session in other places.

HttpFoundation - Uses locking and other mechanisms and is pretty much get-up-and-go. If you follow object oriented programming and are familiar or interested in Composer, this is an absolute breeze to get set up.