I own a website which has a database for users. When accessing a certain part of my website, the sso ticket is displayed in the url, because the only way of connecting to a component of my website is by making the url request followed by /?sso={{player.auth_ticket}}. This gets the SSO from the database. If by any chance someone gets the sso by seeing it in the url they can use it to impersonate users by loging in with their accounts.
I was told by the developers of the project (the website is mine but the project is open source) to use an iframe. That way the sso wont be displayed. The problem is that when using an iframe the above mentioned component cant get the sso, even if I add /?sso={{player.auth_ticket}} to the url.
So I asked again and someone told me to make a request to mywebsite.com/api/ssoticket to get the SSO and add it to the iframe. This is what I've done so far:
Pressing a button in my website leads to this html:
<html>
<head>
<title>My Website</title>
</head>
<body>
<iframe src="https://mywebsite.com/directory/?sso={{player.auth_ticket}}" style="border:0px #ffffff none;" name="" scrolling="no" frameborder="0" marginheight="0px" marginwidth="0px" height="100%" width="100%" allowfullscreen></iframe>
</body>
<html>
As I said, adding the sso request to the iframe link doesnt work. Following the devs advice I tried to make a .js file that makes a request to the SSO api but I dont know javascript so I could only do what I found in google.
Going to https://mywebsite.com/api/ssoticket returns a blank page with this text:
{"status":"success","ticket":"5099crandomNumbersAndLettersa03efnotARealSSOd163e820"}
I found a tutorial to make a request to an API in google and created this .js file:
const userAction = async () => {
const response = await fetch ('https://mywebsite.com/api/ssoticket');
const ssoTicket = response.json();
}
But I dont know what else I can do as I dont know how to add the response data to the url in the iframe. The idea is to get the sso and add it to the href. Something like /?sso=api_sso_response_data
Any help is appreciated