How should my main web application (A) securely retrieve data from my content storage web application (B)?

Question

I have two web applications (A) and (B).

(A) is my primary web application.

(B) is purely for content storage, such as file uploads by users of (A).

What's best way to securely retrieve data from (B) into (A) but in a way that does not expose the data in (B) to potential discovery by third-parties over the public internet or nosy users of (A)?

For example, if I use a HTML form POST from (A) to (B) to retrieve user data, and have a hidden form field called user_id=1, then someone could simply change this to user_id=2 and see the content owned by another user of the application. That would be a problem.

Answer 1

if you have a proper database in the back somewhere, you can use that to validate the access privilege of the requesting user (also depends on the type of connection pool you are using i suppose).

Answer 2

I believe You are mixing conceptes. Access to data is one thing, and url's that give user that access is another. You have to describe problem further, we don't even know if those applications use database.

Answer 3

You should maybe consider basic authentication (username/password) for authenticating users. System (A) will then use a username and password to authentication itself with system (B).

To secure the username and password (which are part of the HTTP request), use HTTPS. Otherwise this data will be sent in clear text.

Answer 4

Why?

Why do you have two applications like this?

Answer 5

You could use Oauth http://oauth.net/

http://apiwiki.twitter.com/OAuth-FAQ

http://oauth.rubyforge.org/