I am trying to assess secure ways to implement a session handover between an app and a website in the same company ecosystem.
Mobile Application A and Website B use the same company OpenID Connect (OIDC) provider to login their users independently from each other with completely separate session handling. Single-Sing-On (SSO) is supported by the provider.
Now App A wants to seamlessly handover the user to Website B to continue his/her business flow.
While this is normally a run-off-the-mill SSO setup, the issue arises, because App A keeps it's own session states independent from the device's browser. (It can even switch between previously authenticated users without re-authentication with the SSO provider.)
i.e. When the App A hands over the user to the Website B, the browser session is probably not signed-in any more to the SSO provider, causing a login prompt. This shall not happen, though.
The proposed workaround
It is now proposed that App A should pass the IDToken of the user to Website B.
Website B is now expected to take this IDToken and log-in the user with it seamlessly.
i.e. The login should work independently from an existing SSO session in the browser just by trusting the IDToken.
Website B can validate the IDToken and it's Signature against the OIDC Provider.
While this is technically possible I have my doubts that this is a particularly good idea.
I have a hunch that this might lead to some security holes. E.g. When a man in the middle intercepts the IDToken.
I am not even sure it is a good idea to pass on the IDToken to other services in the first place (Even though they reside in the same company and want to hand-over user sessions to each other).
Do you know of any established seamless handover flows between an app and a browser website that are considered safe?
Or maybe there is a common way to seamlessly create an SSO session just based on the passed IDToken?