Hello folks,
I'm building a pretty big web app which requires authentication everywhere across 2 domains:
http://my.website.com
http://www.website.com
Since cookie are restricted to 1 domain and I need improved security here's what I figured
User come to the Login page. They enter login and password.
A hidden field contains a temporary unique key who has been generated and store in a AuthenticationKey table.
When user submits, I first check login/password AND if correct I check if the key exists. If true, then I delete it.
User is authorized and I create the cookie. The cookie, for security reasons can't store private data (login/password). That why I generate an AuthenticationTicket which will be store in the database.
The authenticationTicket contains
- a unique identifier
- the ip address of the user
- an expiration date
- the user id
If the user has checked "auto-identification ...
Go to the complete details ...