Our current project has a partner company which wants to redirect to our site and continue a journey which is in our site. They will be sending data of their logged in user along with the redirect.
What is the best way to ensure that redirect is from that specific domain and the data is sent securely.
I was thinking of using HTTP referer header along with encrypted data in the query string?
along with encrypted data in the query string?
will only work securely if the client or the original server has sent you the information needed to decrypt it already - and if the client knows how to decrypt it, the client could tamper with the data, and tamper with the request headers, allowing them to get to the second site despite not coming from the first. (Yes, HTTP referrers can be forged. In general, nothing done on the client-side is trustworthy.)
The secure way to do this would be to, when the sender site is sure that an authenticated user can be authorized to redirect to your site, have the sender site send a server-side request to your site's backend, encrypted of course. Your backend can save the information or token in a database, then tell the original site that the request has succeeded. Then the original site can communicate to the client that they can redirect to your site. When a client reaches your site, look up the (encrypted) token in your database to ensure that such a request was made in the past few seconds, and that the token hasn't been used before.
Setting up all the cross-site communication does take some effort, but once done, you can be sure that the only users permitted will be authorized by the original site.
The ideal way to integrate SSO (Single Sign On) between two apps is to use enterprise integration technologies like SAML, OAuth etc.
If that is not possible, they should send a user with a unique token (GUID/UUID)
Your code then calls a URL on the partner app's server to validate the token and get the user's identity.
This will make sure that the user's identity can not be tampered with in the redirect request.
User's identity information should NEVER be passed as part of the HTTP(S) request as that can be tampered/changed by using proxy tools like burp or fiddler etc.
One way to achieve this is implenting SSO between two applications. If you use SAML SSO, you can always secure the redirecttion using a certificate and signing and verifying data coming and going.
