I am fiddling about with a sort of single sign on procedure. Let\'s say there is

Question

I am fiddling about with a sort of single sign on procedure. Let's say there is site1 and site2 and both use an SSL certificate. Users are signed in on site1. I was wondering what the experts think of this way to let users automatically sign in on site2 that is hosted on a different server:

1. clicking on a link in site1 gets the url (on site2) and 2 codes from a database
2. site1 redirects to the url (on site2) and sends the 2 codes as a post request
3. Site2 checks if the page that is redirected from is really from site1 and if the combination of the codes are correct
4. If so site2 creates a hash and stores it in the database and sends the result back to site1
5. Site1 redirects to site2 and sends the hash
6. if the hash is in the database and was received from site1 and within a short time after creating it the user is logged in.

Is this a (fairly) secure way for a signle sign on procedure or is this horribly insecure? If the latter: where do the dangers lie?

Explanation / Answer

You simply state "site 2 checks if the page that is redirected from is really site 1"... how? There isn't a good way to do this without further information that site 1 can use to verify it's identity via a challenge from Site 2.

This also seems overly complex for passing an authentication. All that really needs to be done, as long as Site 1 and Site 2 both communicate with each other and know each other, is for them to agree between themselves on a token and redirect the user with that token so that one site knows it is the same user that was on the other site.

Don't roll your own, use OAuth or something similar, it will allow better integration with more sites and is also a well supported and tested standard.

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.