Using SSL domain for login to webapp on non-ssl domain

Question

I'm building this webapp where users can build their own online presentation using html and javascript (these uploads will be on AWS S3, not on the server itself). They hookup their domainname to the application. I have the following setup but like to know if this is the safest setup in terms of security and/or what the risks are, thank you for helping out!

Global setup

1. When a user login to the admin from a non-sl domain ( http://userdomain.com ), the loginform post the credentials directly to the SSL login domain ( https://logindomain.com )

2. On logindomain.com the verification happens and when succesfull a new PHP session is started. The session is only valid for the userdomain.com. The session_id is also saved in the database for this user account.

3. Then this session_id is send to userdomain.com over $_GET (2-way encrypted)

4. Add userdomain.com the sended session_id is verified to the useraccount in the database and if ok a new session is started based on this session_id. When the new session is done, the session_id is being regenerated and updated in the database. This session is valid for a limited time (in terms session timout but also in the database)

5. The user is then forwarded to the application (non-ssl) because he is loggedin

6. On each page the users session is verified to the database based on session_id and valid timewindow.

The server is not a shared hosting setup so there are no other virtualhosts who share sesssion data.

Is this login setup safe or how can it be made more secure?

Thanks! Cheers

gr. Dennis

Answer 1

When a user login to the admin from a non-sl domain ( http://userdomain.com ), the loginform post the credentials directly to the SSL login domain ( https://logindomain.com )

This suggests that the form it served over HTTP. It can therefore be intercepted and edited so that the credentials are captured by the attacker. This is not secure.

The user is then forwarded to the application (non-ssl) because he is loggedin

Any page that contains (or will contain) data that needs to be secure should be sent over SSL. You should not leave SSL once the user is logged in, doing so exposes you to Firesheep-style attacks .