跨域登录

Question

Let's say I've one site LoginSite and other two sites site1 and site2.

Now, If user logs in from LoginSite then he/she should be automatically logged in into the site1 and site2.

---

I've tried below two ways for the same

Way1 :: using ajax

I've white listed LoginSite's domain into site1 and site2.

But, It has only enabled cross domain ajax requests. It is not storing session for site1 and site2.

Way2 :: using cURL

I've tried the same using cURL by set of below code.

$username="[e-mail]"; 
$password="mypassword"; 
$url="http://site1.com/api/login"; 
$cookie="cookie.txt"; 

$postdata = "username=[e-mail]&password=mypassword";

$ch = curl_init(); 
curl_setopt ($ch, CURLOPT_URL, $url); 
curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, FALSE); 
curl_setopt ($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6"); 
curl_setopt ($ch, CURLOPT_TIMEOUT, 60); 
curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, 0); 
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1); 
curl_setopt ($ch, CURLOPT_COOKIEJAR, $cookie); 
curl_setopt ($ch, CURLOPT_REFERER, $url); 

curl_setopt ($ch, CURLOPT_POSTFIELDS, $postdata); 
curl_setopt ($ch, CURLOPT_POST, 1); 
$result = curl_exec ($ch); 

echo $result;  
curl_close($ch);

Above code is not working. There must be something missing. I guess somehow I've to return sessionID from site1 and use it.

Pl. help/guide me how to do this.

Note : I do not want to post form to site1 or site2

Answer 1

LoginSite must generate a UniqueID and give it back to the connected User, it will be used as a token
When User connect to site2 it will send his token, and site2 will ask for his validity, if it still valid, so it will accept the connection and creting a session

Conclusion : think about token, validity and security :)