Cross site security.

Forum Moderators: phranque

Message Too Old, No Replies

Cross site security.

How to make 2 sites talk to each other securely without SSL

Dabrowski

6:35 pm on Dec 22, 2008 (gmt 0)

I have a few clients now asking me about customised webapps, and very simple dynamic content systems such as adding a new news headline.

Obviously these clients want their portals to be secure, but the cost of SSL sometimes is overkill for what they need.

I want to set up a website to validate logons with SSL, then once the credentials are verified the client would be directed back to their portal.

There would have to be a session set up on the portal site, preconfigured to accept a connection from the client IP address.

I think all this can be done, and protected with referring IP addresses, but I'm not entirely sure if a referrer address can be faked?

Dabrowski

8:33 pm on Dec 22, 2008 (gmt 0)

Sorry, wrong question. I don't mean can a referrer string be faked, obviously that can.

I meant can the client IP be faked, or the IP addresses of the servers talking to each other?

LifeinAsia

8:36 pm on Dec 22, 2008 (gmt 0)

but the cost of SSL sometimes is overkill for what they need

You can setup SSL for free with OpenSSL- perfect for use on an intranet.

Dabrowski

8:41 pm on Dec 22, 2008 (gmt 0)

I've not used OpenSSL, to save me delving through various incomplete manpages, have you used it? Does it work? Can it easily be integrated into my application?

LifeinAsia

10:15 pm on Dec 22, 2008 (gmt 0)

I've used it on several intranet sites. The first couple of times I had some problems, but then just added my notes to the documentation.

The setups I've been using are Windows/IIS configurations. Not sure if that will work for you. But I am sure there are other free/open source options available for other configurations.

But if that configuration will work for you- I highly recommend [dylanbeattie.net...] (just make sure you do NOT do step 3!).

Dabrowski

11:11 pm on Dec 22, 2008 (gmt 0)

On intranet sites using IIS, why not just use Windows CA?

I've had a look at this, I don't think it's what I need really.

I probably should clarify something, the reason only the logon needs to be secure is that the portal itself won't contain any secure information.

The process I have in mind is:
1. Client accesses portal (or logon site directly)
2. (client is redirected) authenticates with logon site ok
3. Logon site sends something, like a pre-configured session id to portal
4. Logon site redirects client to portal

So the mechanism I need to be secure is the logon site talking to the portal. It's probably only going to execute one command but if it's spoofable then there's no point having a secure logon.