Cross web domain login with .net membership

Question

Hi all,

I currently have three websites all running from the same DB

example websites:

• www.mysite.com
• admin.mysite.com
• members.mysite.com

now because this all runs from a single DB they all use the same .net Membership tables.

• All members are in a role: Member
• All Admins are in a role: Admin

So the admins can log into the admin site and access all their admin functions etc, but the members if they tried to log into the admin area are bounced back to the login screen without any message, what I want to happen is to redirect them to the site: members.mysite.com and have them logged in.

As I could send them to a page in the admin site that does a response.redirect('http://members.mysite.com'); but then they have to login again.

So is there any good way to do this, or am I left doing something unsecure and hacky with querystring?

Answer 1

Querystring is fine as long as you use a unique 'one time token' that gets deleted after it's used to perform the login (this is how Google does it).

EDIT - Basic procedure is

1. Generate a cryptographically secure token
2. Store token/username combo in database
3. Redirect to new site with ?token=XXXXXXXXXXXXXXXX
4. New site sees token, looks up matching username in database and deletes token
5. Perform login procedure as that user