Securely passing login token from one website to another in a shared database
<p>I have two websites on different servers and I need to permit single sign on from one site to the other. Both websites have access to the same database. Users are already authenticated and trusted on website A, but I'd like for them to click a link and automatically get logged into and redirected to website B. I have looked into SAML and other SSO options, but because both sites can access the same database, I'm wondering if I can use a simple token to permit SSO?</p>

<p>The setup is:</p>

<p><code>www.websiteA.com &gt; databaseA</code></p>

<p><code>www.websiteB.com &gt; databaseA</code></p>

<p>I was thinking something along the lines of:</p>

<ul>
<li><code>www.websiteA.com/sso.php</code>

<ul>
<li>Create a random token record in databaseA associated with that user, let's say ABCD1234</li>
</ul></li>
<li>Redirect to <code>www.websiteB.com/login.php?token=ABCD1234</code>

<ul>
<li>Check databaseA for that token, and log the associated user in</li>
</ul></li>
</ul>

<p>Is this a secure way of performing single sign on between these two websites? Is a URL variable secure if it is performed over HTTPS and if the token is only destroyed after it's use?</p>