I have a .net core backend using Identity and when a user logs in using a password and email the client sends it up to the API and a auth token is generated, that token is then sent back in the redirect url as a query param so that the subdomian can store it in the local storage and use it to make http requests as this logged in user.
Is this secure?
The redirect url would look something like:
https://sub.domain.com?token=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&user=xxxxxxxxxxxxxxxx