We offer a number of online services. We are required to develop a system which provides a quick/simple experience for users if they are transferred from one service (on domain1.com
) to another service (on domain2.com
).
Is there a safe and secure way to log a user in automatically once he has been transferred to the new service?
Yell at me if the solution below is completely insecure/wrong.
We were considering a system similar to that provided by a number of online services for password recovery - they are emailed a link with a unique hash which expires, that allows them to change their password.
The domain1.com
site would generate a unique hash and store it in a database with the hash linked to a user along with an expire datetime field.
The user will be transferred to domain2.com/auto/?hash=d41d8cd98f00b204e9800998ecf8427e
domain2.com
would next make a request to domain1.com
with the hash to get the information about the user. domain1.com
would then remove the hash from the database. domain2.com
would log the user in and set cookies, etc.
Could something based on OpenID or OAuth achieve the same results?