Question

This is going to be weird sorry and hopefully I’m posting it on the right website.

I got this question from an interview.

If I got two servers, one media and the other hosting a website that require user authentication.

The user have to login to the website hosted in one server before accessing the media server. Only authenticated user can access the media and the media server.

I’m not sure how to go about this via PHP? I believe I can do this via sys admin and setting up kerberos server a ticketing system. But for PHP I can only think of maybe some form for RSA public-private key encryption?

Another solutions/hacks was to create some kind of hash and append it to the URL.

Or

Check the user IP? everytime the user access the media file?

Note, the company I applied for, the manager didn’t seem very skill at all. So maybe there is no safe solution?

Note:

I’m pretty sure I can’t use PHP’s session it’s contained in a server? Perhaps a cookie? Is that even safe…

Thank you in advance.

Answer 1

Use a common domain for both servers and then perform a domain level authentication with an encrypted cookie where both servers have the same private decryption key.