Universal user profile for subproject sites - secure transfer of user data from the main server

I have a site ( A ) for a main project with a custom system (which should display all student competitions and academic events in my country for registered users. The site also allows users to sign up for these events and some other things. Account A includes only basic information like name, school, email, area of ​​interest, ...)

I also create site ( B ) as a "subproject" (to search for part-time jobs and collaborate with larger organizations in the subject area. Also, there will be more similar future subprojects, so ( B ) is a collection of subsites). Sites B require the same data as A , and a few more are required to complete. All sub-projects will be supported by the same group of people as the main project.

I thought it would be nice to allow users to log into B sites with an account from A , and also make it possible to sign up for B with an individual account, because users usually don't need to come from just the main site A and they might only be interested in B ...


Both servers are running PHP and MySQL services. B's sites won't be hosted on the same server as A , so they'll have to communicate over the internet, obviously.

I was planning the following scenario:

  • User logs into B with credentials from A
  • B hash the password and send it with username through secure channel A
  • A compares the user's and hashed password against its database and sends an error message, or
  • B logs the user into

But my main concern is the communication security part, I was looking for some of the reasons that servers would need a certificate to recognize each other, but I didn't find any specific piece of code to start with.

There is also a problem with persisting user data because B has to show a specific field on a public website, it would be pointless to search for them on a remote DB I guess. But this results in user A's profile fields being persisted on server B , so it would be useless to do all of this anyway.

Any advice would be appreciated!

+3


source to share


1 answer


Ok, if you have admin access to your servers, you can set up site to vpn site to allow communication between servers.

You can also install SSL certificates on your servers and send data over SSL secure channels



Another option is to encrypt messages sent between servers using Php.

0


source







All Articles