0

We are developing a single ASP.NET website that is hosted on multiple domains:

  • website-a.com
  • website-b.com

Both websites allow users to login. We are trying to enable it so that if a user logs into website-a.com, they are automatically logged into website-b.com. Obviously because of cross-domain security there can't be a single cookie set to serve both domains.

We were thinking of setting up a 3rd domain, auth.company.com, the website will run on that has a couple of simple endpoints:

  • /authorise will be the endpoint that both website-a and website-b use to authenticate the user
  • /client-id will be the endpoint that both websites will use to see if the user is already authenticated

When a user hits website-a.com an AJAX request will be made to auth.company.com/client-id, if the user is authenticated then an identifier will be returned, website-a.com will set a cookie, ideally referencing the same ASP.NET Session as the other websites and refresh the page.

All websites will be running over HTTPS, and I was contemplating encrypting the client-id sent back from the authorisation server, but figured this may not be necessary since if a user has access to this information, they could just spoof the user's ASP.NET session cookie anyway.

The questions I have are: is this safe? is this sane? is there another/better way of doing this?

We ideally want to avoid introducing something as complex as OAuth2 or OpenID as the above mentioned functionality is the extent of what will be required.

Brendan
  • 3,415
  • 24
  • 26
  • See http://stackoverflow.com/questions/26309792/asp-net-identity-in-microservice-architecture/26310977#26310977 – Brendan Green Sep 14 '15 at 04:59
  • 1
    Personally I would shy away from anything even remotely resembling shared cookies or shared session. You can follow the OAuth model without going through an external authorization server by creating your own internal authorization server. That way you can persist a token across multiple applications that continuously returns to a single source of truth for authentication. That said, this question is too broad for SO as is and I'll be voting to close it. – David L Sep 14 '15 at 05:18
  • Where is a better place to post a question like this @DavidL? – Chris Sep 14 '15 at 05:29
  • @Chris if the OP could boil down the question a little he might have some luck on programmers.stackexchange.com. However, at the end of the day the difficulty is that there isn't a single question present that can be answered by a single answer. it's simply too broad which makes it difficult to answer in the Q&A format. – David L Sep 14 '15 at 12:59

0 Answers0