Cookie based SSO

user_217139 0
Viewed 41956

How can I implement a cookie based single sign on without a sso server? I would to share the user logged in across multiple applications using only a cookie on the browser.

In my mind it's working like this:

  • user logs in an application
  • the application verifies the credentials and then it setting up a cookie on the browser storing the username (that could be coded with a private key)
  • if the user opens another application, it searches the cookie and reads the username on the value (using the key for decode the string)

In this solution a user may see the browser cookie (of a another user) and take the string codified of the username. Then he could adding it on an own cookie (no good!).

There's some secure way to do this? With a timestamp based control or something like this?

Thanks in advance.

Bye

P.S. I know that my english isn't very well.. sorry for this!

single-sign-on
6 Answers

There is a simple solution without using an sso server, but not with 1 common cookie, as we know that cookie's are not shared between domains.

When the user authenticates on site-a.com, you set a cookie on site-a.com domain. Then on site-b.com, you link a dynamic javascript from site-a.com, generated by server side script (php, etc) who has access to the created cookie, and then copy the same cookie on site-b.com on the client-side using js. Now both sites have the same cookie, without the need of asking the user to re-login.

You may encrypt/encode the cookie value using a method that both site-a and site-b knows how to decode, so that site-b will be able to validate his cookie copy. Use a common shared secret that without it will be impossible to encode or decode.

You see that on the 1st page load of site-b.com, the cookie is not present, therefore if you see necessary, you may want to do a page reload after setting the cookie.

user_2303790
Related