There are two projects, for example, project_A and project_B. The project on the identical machine, the database may not place on a machine.Most of the pages in both project_A and project_B need authentications and authorizations. For some reasons, I now need through the project_A to connect the pages contained in project_B.
How the users belong to the project_A can be recognized by project_B.How can I make the process safe?
User_A -------------> User???
----------------- Request ----------------
Project_A ----------> Project_B
----------------- ----------------
I have made some essential methods.
1.Cookie and Session
Session can't work in the cross-site, Cookie may use, but has the request regarding the connection string of character(URL).
2.Session state
I didn't understand it very clearly.I only knew session state has special state the service managementamd, and the projects need to work with the database in the same computer.
3.Extended Forms Authentication and SSL
I thought this is the quite good method.Different projects use the same encrypted machineconfig in the file named web.config, and the key will be saved in the register.
Code:
<authentication mode="Forms"/>
<machineKey validationKey="BC96635A96D0561BA5E7CEECDC29A3166ED0B8EBF7564
95653B0C6C1389E081A4BDE0FAD53F9933E3AA3044A3C2E13985736D7C18B69DF21A
EAB" decryptionKey="8A424F4F4EE4D357AED944665C2CBEB47D64E448989628AC" validation="SHA1"/>
4.I write common security module in both projects.
Thank you!
Cheers,
Zhangguoyi
No pains, no gains.
Cross-site security problem!
