Passing authentication data to another website - security

Question

There are two applications AppA and AppB. User is authenticated in AppA. When users clicks a link in AppA I want to redirect him to AppB and pass authentication data to AppB, so user can be automatically authenticated in AppB under the same credentials. Is there a common approach of passing authentication data from one website to another? How can I do it in the most secure way?

Answer 1

You could pass the username and password encrypted over a query string or a shared cookie.
If you have the private_key shared on AppB you can decrypt anything you encrypt on AppA.
Run this to generate your public and private key.
openssl genrsa -out public_key.pem 2048
openssl rsa -in public_key.pem -pubout > private_key.pub
Here you can encrypt\decrypt using your new key.
function encrypt($data)
{
if (openssl_public_encrypt($data, $encrypted, file_get_contents("/home/blah/key/private_key.pem")))
$data = base64_encode($encrypted);
else
throw new Exception('Unable to encrypt data. Perhaps it is bigger than the key size?');
return $data;
}
function decrypt($data)
{
if (openssl_private_decrypt(base64_decode($data), $decrypted, file_get_contents("/home/blah/key/private_key.pem")))
$data = $decrypted;
else
$data = '';
return $data;
}