title: Unique identifier in SSO authentication
body: <p>Good afternoon. I'm creating an authentication system via SSO.</p>
  <p>Let's imagine the following scenario:
  Site A: forms.nso.imm.pt (Backend: backend.forms.nso.imm.pt)
  Site B: auth.aettr.pt (Backend: backend.auth.aettr.pt)</p>
  <p>Now I want a user, when clicking on the login button on Site A, to be redirected to the Authentication portal of Site B, and with that the user can authenticate himself with the credentials of Site B. For this, when the user clicks on login , currently the frontend of Site A, communicates with its own backend, which in turn communicates with the backend of Site B, to create an authentication session token, then this token is returned to the backend of site A, and in turn returned to the front-end of site A, which in turn forwards the user to the frontend of site B, passing the previously created token via query string. But it just creates a vulnerability. If a malicious user creates an authentication session, copies the URL and sends it to the victim, the victim sees that the site is real, because it is indeed an authentication, and logs in, then the malicious person just needs to refresh and he will be redirected to site A with the victim's session.</p>
  <p>For that I've already tried on the backend of site B along with the authentication session token, create a uuid, record it in the database along with the token, and automatically create a cookie with that uuid. So when the user opened the front-end of site B and it was going to validate the authentication session token, if the cookie did not exist or was not the same as what is in the database, he would not let the login, because a victim would never have the cookie created at the time of the authentication session token creation process. But unfortunately this is not possible because I cannot create the cookie, because the user &quot;does not open&quot; the backend domain of site B.</p>
  <p>Does anyone know any other ways to resolve this vulnerability via cookies, or otherwise? (Except browser fingerprint)</p>