Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I have 2 apps. They both have accounts, and each account has users.

These apps are going to share the same users and accounts and they will always be in sync.

I want to be able to login automatically from one app to the other.

So my solution is to generate a login_key, for example: 2sa7439e-a570-ac21-a2ao-z1qia9ca6g25 once a day. And provide a automated login link to the other app... for example if the user clicks on:

https://account_name.securityhole.io/login/2sa7439e-a570-ac21-a2ao-z1qia9ca6g25/user/123

They are logged in automatically, session created.

So here we have 3 things that a intruder has to get right in order to gain access; account name, login key, and the user id.

Bad idea? Or should I can down the path of making one app an oauth provider? Or is there a better way?

share|improve this question
    
maybe better asked on security.stackexchange ? –  Martin Ba May 25 '12 at 7:40
    
Yes...This is a bad idea. –  Ramhound May 25 '12 at 14:19

2 Answers 2

up vote 1 down vote accepted

If done correctly, it's a good idea and improves overall user experience.

I would read up on the Kerberos protocol and get some ideas on how to implement. You won't need to reinvent the wheel in this case, as several folk have already implemented exactly what you're suggesting.

share|improve this answer

Better to use SSO(single sign on) software like LDAP. your idea is fine too. but my suggestion is to use apps for what they are made not for user authentication. and if your one app got crash that is authenticating user, the other will got effect too.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.