CODEWITHSUNDEEP
asp.nethtmlasp.net-mvcsingle-sign-on
Jin Ho
Jin Ho

Reputation: 3665

A simple SSO across domain

Suppose I have 2 website: domain1.com and domain2.com

I implemented sso as following: Once user login successfully with domain1.com, I generate an iframe to make him logined in domain2.com as well.

<iframe width=1 height=1 src="domain2.com/sso-login?username=abc&password=encripted_password" />

On domain2.com, I implement a method sso-login to handle this call, if username & password are valid, I create auth-cookie to return to browser. Therefore, when he open domain2.com in other tab, he will be logined automatically.

The same flow when user login in domain2.com, I generate an iframe to make user logined in domain1.com.

I wonder if there's any security holes or disadvantage points in this implementation? Is there something else I should do to make it more security?

Upvotes: 1

Views: 783

Answers (2)

Darin Dimitrov
Darin Dimitrov

Reputation: 1038710

Don't send the username and the password. Only send the authentication token:

<iframe width=1 height=1 src="https://domain2.com/sso-login?token=<%= Request.Cookies[FormsAuthentication.FormsCookieName].Value %>" />

and then have both applications share the same machine keys, so that the remote domain could decrypt it and emit a Forms Authentication cookie for this domain. Also make sure that you are only sending the token over HTTPS.

Upvotes: 2

Johni
Johni

Reputation: 2961

You will run into problems because many modern browsers doesn't allow cookies to be set in a iframe pointing to another domain.

Upvotes: 0

Related Questions