title: How do I authenticate a login on two different servers?
body: <p>I've developed a CMS app, that stores all the client's files on their server but does the processing on mine (i.e. keeping hold of the valuable code I developed, while not allowing user submitted code to make my site vulnerable). Now the issue is the user has a control panel to edit their website, this is hosted on their website, it's a 1 page thing, but the login details/sessions are always on my website. </p>
  
  <p>I was thinking of having a way of making the edit page on there site only accessible if a token passed is valid, both sites can have the same way to develop and check the same token. Is this acceptable security, I mean the only exploit I can think of is if the URL was somehow sniffed and used independently in the same time frame that the token is still valid. Checking headers is an optional extra bit of security but these can be faked so it's not an absolute solution. I don't know how easy it is to sniff a users web traffic, would this method be ok to use? </p>
  
  <p>Thanks in advance.</p>