Home | Contact Us | FAQ | Search & Site Map | Link to Us
Sign In | Join | Other 45 Sites in Network
HomeAnnouncementsFree MagazinesWhite PapersSubmit Content
Discussion GroupsASP.NETWindows FormsLanguages.NET FrameworkVisual Studio.NET
Articles.NET FrameworkASP.NETToolsWindows Forms
.NET DirectoryOpen Source ProjectsUser GroupsWeb Resources
Related Topics
Visual Basic 6SQL ServerMS AccessOther DB ProductsMS Server ProductsMore Topics ...

.NET Forum / .NET Framework / Security / April 2006

Tip: Looking for answers? Try searching our database.

Securely Passing Info Between Two Websites

Thread view: 
Enable EMail Alerts  Start New Thread
Thread rating: 
anewell@valassis.co.uk - 25 Apr 2006 10:19 GMT
I need to build website on my webserver which has information securely
passed to it from a  web site running on a client's webserver.

My client has a website that has a secure login process running under
SSL.  When a user has succesfully logged into that website they will be
able to follow a link to my website.  As part of this link I need an id
of the user to be passed to my website so I know who the user is,  I do
NOT need the user's username or password.  The ids of all users is
already known to both websites.

My site can run using SSL and the simplest solution is to pass the id
of the user as part of the query string, i.e. the link is an anchor
with a HREF such as WWW.ADYSITE.CO.UK?id=123456789',  but I do not know
how secure this is.   I could envrypt the querystring so it is not
reable but I am not sure if this is necessary if I am using SSL,  this
would mean that both the client and I would need to share envyption
keys.

I would like to limit the the amount of work the client will have to do
at their end so I need the simplest solution possible.

Any advice as to possible solutions would be welcome.

Regards
Ady
Alun Jones - 27 Apr 2006 16:27 GMT
> My client has a website that has a secure login process running under
> SSL.  When a user has succesfully logged into that website they will
[quoted text clipped - 10 lines]
> this would mean that both the client and I would need to share
> envyption keys.

What you're looking for is commonly known as "Single Sign-On", or SSO.

It's usually securely implemented by using a piece of data in the query that
contains the ID, a "nonce" (a random number), or timestamp, and a signature
of this set of data.  That data-set allows you to ensure that the ID was
verified by a server that you trust (that's the signature part), and that it
wasn't copied over from some previous query (that's why you have the server
sign the ID _and_ the nonce).

A search for "SSO" or "Single Sign-on" should give you more details, and may
provide you with links to standard solutions, or readily-available
third-party implementations.  Generally, you do not want to write your own
cryptographic components!

Alun.
~~~~
[Please don't email posters, if a Usenet response is appropriate.]
Signature

Texas Imperial Software   | Find us at http://www.wftpd.com or email
23921 57th Ave SE         | alun@wftpd.com.
Washington WA 98072-8661  | WFTPD, WFTPD Pro are Windows FTP servers.
Fax/Voice +1(425)807-1787 | Try our NEW client software, WFTPD Explorer.


Free Magazines

Get these publications absolutely FREE for up to 12 months. There are no hidden fees and no obligation. Simply choose a title, complete the application form and submit it. Read more ...

Oracle MagazineNetwork ComputingComputer WorldBio-IT WorldeWeekInformation WeekInfosecurity
 
Sign In
Join
My Latest Posts
My Monitored Threads
My Blog
My Photo Gallery
My Profile
My Homepage

Start New Thread
Enable EMail Alerts
Rate this Thread



©2008 Advenet LLC   Privacy Policy - Terms of Use
This website includes both content owned or controlled by Advenet as well as content owned or controlled by third parties.