how to make a cross domain request that isnt forgeable

Question

I need to get some data from Site B into Site A 's server side. In order to make the request to Site B to retrieve the data, there are cookies associated with Site B 's domain which need to be present. I assume I therefore need to do this in javascript with JSONP?

My ideas was to use JavaScript to make the request to B and then capture the result and stick it a cookie on A s domain such that subsequent requests to A would carry the cookie with the returned data (it doesnt matter that it takes two requests to A to get the information to A 's serverside). This would work fine, except its completely hackable.

The data itself isn't secret but I need to prevent request forgery or people on Site A calling the JSONP callback function manually, or setting the A cookie manually with stolen or otherwise faked data. Also, is there any other loophole for hacking? This would also need preventing!

The only way I can think of doing this is:

Site A generates a random token and stores it in the session. It then appends this token to the querystring of the JSONP request to Site B . Site B then responds but encrypts the usual data along with the token using digital signing. Site A then sticks this value in a cookie on A . In the next request to A , A s server side can capture the cookie, get the value, decrypt it, check the token and if it matches the value in the session, trust the rest of the data.

Does this sound sensible? Is there an easier way? My goal is to reduce the complexity at A s end.

Thanks

Answer 1

The way to avoid it being hackable is to have the sites communicate with each other directly, rather than using client-side JavaScript. Write a small light-weight REST API which allows the data to be transferred behind the scenes, server to server.

When linking to Site A, include an authentication token in the URL which can then be checked using the behind-the-scenes call to Site B. This call can transfer any additional required information. The token should probably be IP-bound, and expire after use. Upon success, you can set up your cookie information in Site A, to avoid the need for further round trips.

Answer 2

You could use easyXDM to communicate between the domains. With it you have two javascript Programs, one on the consumers domain, and one on the providers, which can assert the domain of the consumer. Both these Programs can interact with the user, and the user can authenticate itself to both parties. With the providers Program knowing who the user is, and knowing who the consumer is, the provider can pass whatever data it wants to the consumer.

This is what big companies like Twitter, Disqus and LinkedIn use for their API's.