title: auto login by requesting security token
body: <p><strong>scenario:</strong></p>
  
  <p>clientWebsite can only be accessed when a user has their security card inserted into PC.
  ClientWebsite is outside of my control, as is everything to do w/ the security card.</p>
  
  <p>I developed a js web app that requires username/password. The system requests a security token, and if provided credentials are valid, a token is returned and appended to all requests as a url parameter. Token is valid for 60 mins.</p>
  
  <p>The sys admin of ClientWebsite wants to put a link to my js app on their secured site. If someone is able to view ClientWebsite, they are allowed to view my js app, and after following the link, should not have to login again. </p>
  
  <p>I had sys admin insert a test link that would point to a page on our server and execute some js/jquery to retrieve http referrer, but it was always blank. Conclusion -- our client's browsers likely have referrer disabled, or ClientWebsite is configured in a way that disables sending referrer. Not surprising, this is a very secure site to say the least.</p>
  
  <p>It would be easy to request a security token via ajax/php before leaving ClientWebsite (i would provide code to sys admin to put in ClientWebsite). This method would use hard coded credentials in the php script, return/append the token to the link so it's available when arriving at my js app. The js app would then check token's validity, and if OK, the login is suppressed on js app. </p>
  
  <p><strong>problem:</strong></p>
  
  <p>Someone could c/p the ajax call from ClientWebsite, run it outside of ClientWebsite, obtain a token, pass token to someone else who could use it to access my js app.</p>
  
  <p><strong>question:</strong></p>
  
  <p>I'd like to check for referrer in the php script, then issue token if referrer matches ClientWebsite, but no referrer is being sent &amp; referrer can be spoofed anyway. What other method could I use to determine the request for a token is actually coming from ClientWebsite page? </p>
  
  <p>Thanks!!</p>
  
  <p><strong>edit:</strong></p>
  
  <p>supply sys admin with ajax call like so:</p>
  
  <pre><code>$('#jsAppLink').click(function(e){
      e.preventDefault();
      var currentHref = $(this).attr('href');
      $.ajax({
          "type":"post",
          "dataType": "jsonp",
          "url": "https://mydomain.com/getTokenUsingCurl.php",
          "success": function (returnData){
              newHref = currentHref + "?token=" + returnData.token;
              window.location = newHref;
          }
      })
  })
  </code></pre>
  
  <p>onClick, a php script on my server is queried. This script contains hard coded creds. out of public view. Return token to ClientWebsite, append it to js app url, then continue with link click routing user to js app. </p>