集中登录/注册的可能问题

Question

I've build two seperate browsergames and I want them to share the same login system. So that if you have one account which you use for both games. I want this because of payment reasons (if they buy something I have to pay per website so I want all payments to come from one website) and user experience (why sign up multiple times?).

But when they first sign up and login I do not want to redirect them to the centralized system because I want the sign-up/login-proccess to be as simple as possible because I'm afraid they'll lose interest.

So I was thinking about letting them sign in to the website normally and then using cURL to send the requests to the centralized website by building an API.

I am however wondering if this is a good approach because none of the websites are on the same network. I guess I'll have to build the centralized login system in such a way that it only accepts requests from the domains the games are on. But are there any other things I have to worry about? How should I send for example passwords? Because sending them plain text seems like a horrible idea so I guess I'll have to hash them on the side of the game. I guess I'll have to make a small copy of the users table for for example the username and user_id.

I don't want to use for example OpenID or Facebook Connect or something because that does mean redirecting to an external system (which is bad for user experience) and the average age off players on the website is about fourteen, so they have no clue about OpenID and I don't want to force them to connect their Facebook accounts to my websites.

Also I'm sorry if I'm unclear or writing in bad English, I'm not a native and having a hard time expressing myself the right way.

Thanks in advance!

Answer 1

If I were you, i'd create a API for registration system.

Website A (game1) uses that API to create accounts and verify them, same does the website B.

API would validate data, respond with errors (username taken etc), or return success messages. It should be protected (LAN access only or some authentication)