Hi folks. I used the search feature but I didn't find anything similar to my situation.
I have a web application (A) but in the future I'll add another one so I decided to have a third web application (UM) to do all the user management in a centralized way. So Login and User Creation are done through web services in (UM) from (A) or other web application.
I created a security token that expires in an specific amount of time and also this token is encrypted. But the rest of the information (email, password, etc) go as plain text. I don't know if this could be a problem.
What I though is to create an object like LoginOrder and fill it with the login information, then serialize it and then encrypt it. In the web service the security token will be decryted and validated and if so, the LoginOrder will be decrypted and deserialized. Then if everything is correct the Login logic will be executed with the data provided.
Am I going to far with security? Do yo ...
Go to the complete details ...