Question

I have two web applications (A) and (B).

(A) is my primary web application.

(B) is purely for content storage, such as file uploads by users of (A).

What’s best way to securely retrieve data from (B) into (A) but in a way that does not expose the data in (B) to potential discovery by third-parties over the public internet or nosy users of (A)?

For example, if I use a HTML form POST from (A) to (B) to retrieve user data, and have a hidden form field called user_id=1, then someone could simply change this to user_id=2 and see the content owned by another user of the application. That would be a problem.

Answer 1

You should maybe consider basic authentication (username/password) for authenticating users. System (A) will then use a username and password to authentication itself with system (B).

To secure the username and password (which are part of the HTTP request), use HTTPS. Otherwise this data will be sent in clear text.