I have 2 apps. They both have accounts, and each account has users.

These apps are going to share the same users and accounts and they will always be in sync.

I want to be able to login automatically from one app to the other.

So my solution is to generate a login_key, for example: 2sa7439e-a570-ac21-a2ao-z1qia9ca6g25 once a day. And provide a automated login link to the other app... for example if the user clicks on:


They are logged in automatically, session created.

So here we have 3 things that a intruder has to get right in order to gain access; account name, login key, and the user id.

Bad idea? Or should I can down the path of making one app an oauth provider? Or is there a better way?

  • maybe better asked on security.stackexchange ?
    – Martin Ba
    May 25, 2012 at 7:40
  • Yes...This is a bad idea.
    – Ramhound
    May 25, 2012 at 14:19

2 Answers 2


If done correctly, it's a good idea and improves overall user experience.

I would read up on the Kerberos protocol and get some ideas on how to implement. You won't need to reinvent the wheel in this case, as several folk have already implemented exactly what you're suggesting.


Better to use SSO(single sign on) software like LDAP. your idea is fine too. but my suggestion is to use apps for what they are made not for user authentication. and if your one app got crash that is authenticating user, the other will got effect too.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.