ExternalAuth

[Cantor, Scott]

On 12/24/13, 4:28 PM, "Nick Amon" <namon at xceedium.com> wrote:
>
>If there is no session ID cookie, or the session is not found in the
>local database, the PHPAuthEngineServletProxy redirects the user to the
>PHP AuthEngine for authentication.  After the PHPAuthEngine has
>successfully authenticated the user and set the PHP session ID cookie, it
>redirects the user back to the PHPAuthEngineServletProxy, which verifies
>that session ID cookie against the database and forwards control back to
>the AuthEngine.
>
>I have implemented this and seems to function fairly well.  I don't see
>any apparent vulnerabilities in this design.

I don't see how you expect that final transfer back to be secure. Without
more information, that seems like a vulnerability.

-- Scott