title: How to pass JWT session token between domains?
body: <p>I would like to support this scenario in my app:</p>
  <ol>
  <li>User visits standard application URL <a href="https://app.example.com/" rel="nofollow noreferrer">https://app.example.com/</a></li>
  <li>User logs in and receives a JWT token from server, to maintain a login session</li>
  <li>App determines that user's account has a custom domain assigned</li>
  <li>App redirects to custom domain <a href="https://custom.customer.com/" rel="nofollow noreferrer">https://custom.customer.com/</a></li>
  <li><strong>User remains logged in</strong> without having to re-login</li>
  </ol>
  <p>Step 5 is the only difficulty. Does anyone have any advice on how this can be achieved securely? I've seen suggestions to pass the JWT as a parameter in the redirect, but this seems exceedingly insecure to me.</p>
  <p>I'm thinking of one option, that may be at least more secure... A one-use &quot;transfer&quot; token could be created by the server. This would be passed in the redirect URL, and the (same) app at the new URL could pass this to the server to get the JWT. Thoughts on this?</p>
  <p>Thanks.</p>