Title: How can I start a session in an app and securely continue it in a browser?
Tags: security;session;access-token
Question: Requirements

I have to split the user experience across two apps:


a downloaded native app
the device's default browser


A user will start by logging in to the downloaded app (username/password).  At some point, the user presses a Continue button that launches a browser tab.  I need the user's session to persist in the browser so I can display personalized content without requiring another login.

Planned Implementation

First the app logs the user in by calling
https://site.com/login?username=USER&amp;password=PASS

... and the server generates a unique session token and replies...

```{
    "sessionToken": "SWORDFISH"
}
```

Then when the user presses the Continue button, the app instructs the OS to open URL...

https://site.com/page.html?sessionToken=SWORDFISH

Questions

With sufficiently long and well-distributed session tokens, can this be considered secure?

Is it bad practice to keep the session token in the URL as the user navigates through different pages on site.com?

Comment: Awesome, thanks for the keyword.  [Session Fixation wiki](https://en.wikipedia.org/wiki/Session_fixation) has lots of discussion.

Comment: Using POST for the app / browser transfer would be best but I don't know if it is possible. Then remove the sessionToken from the URL after the first request, changing it into a cookie. This reduces shared token / sessions on G+ / email / etc ;)

Comment: The first thing that comes to mind is Session Fixation attacks.



{'source': 'StackExchangeDataset', 'subset': 'stackoverflow.com', 'metadata': {'AnswerCount': 0, 'CommentCount': 3, 'ContentLicense': 'CC BY-SA 3.0', 'CreationDate': '2013:00:11/01/13', 'FavoriteCount': None, 'PostTypeId': 1, 'Tags': '<security><session><access-token>', 'Title': 'How can I start a session in an app and securely continue it in a browser?', 'ViewCount': 45, 'id': 19735322, 'user_AboutMe': "<p>I'm into UI, robotics, and volumetric displays.</p>\n", 'user_AccountId': 144809.0, 'user_DisplayName': 'Neal Ehardt', 'user_Reputation': 9500.0, 'user_Views': 416.0, 'user_id': 354144.0}}