Pass user data between web applications on different servers.

Question

We have two different web applications with different servers, stacks, etc. Let’s call one the Host at host.example.com, and the other the Client at client.example.com.

We want our users to log in to Host, and pass their credentials and some other information (real name, email address, DOB, etc) to Client. What is the best way of doing this? The user accesses Client from a Javascript request when viewing a page on Host.

Criteria:

• The most important criterion is that the changes to Host should be as simple and easy as possible.
• We cannot redirect the user (though their JS requests are fair game)
• The Host must be platform agnostic. The Client is Django on App Engine, but that doesnt really matter I think.

Two options we've thought of:

• an API on Client for Host to pass the data. Roughly, on login, the Host fetches login/ on Client, and passes the session ID, along with the data.

• Storing the data is a signed or encrypted cookie. Judging from recent discussions about signed cookies in Django, this looks hard to get right.

Answer 1

It's kind of sketchy, but you could perform a redirect to a page on the Client with the relevant data included as a GET variable. If you do this, you should probably encode/encrypt the data. The Client would pick up the data, set relevant Session information, and continue on it's way.

Answer 2

Perhaps through sharing session state? Here's an example that uses the default SQL Server session provider and tweaking the GetTempAppId sproc to give the same value therefore making storing and retrieving seem as if its from a single app.

Answer 3

There's no simple way to do a good job of this. There are many ways to do it, but none are simple and secure at the same time. You might consider cgi/fastcgi/web service technologies on the host.

Answer 4

I think the best option is the first:

an API on Client for Host to pass the data. Roughly, on login, the Host fetches login/ on Client, and passes the session ID, along with the data.

Perhaps you could use OAUTH to authenticate the requests. There is an open source implementation for App Engine from google and another one here.

Answer 5

You also could use a hybrid of these solutions. If the login generated a hashed/timed SessionID and stored it in a small session db along with the IP/userid, you could store this data in a domain level cookie and pass it right along. The client would then validate the sessionid/timestamp/ip/etc against the db the first time to verify immediate authentication and then proceed on its merry way handling the user and session however it expects to handle it. If you kept the timestamp expectation to something fairly short (10 seconds?), it could be used and consumed, and then a database cron job could be used to prune errant or un-consumed entries.