Is it secure to explicitly setting session IDs in HTTP Requests? - php

Question

I have my account system at accounts.example.com.
When a user logged in at accounts.example.com, the session ID will be saved on a cookie which is available on .example.com (In all subdomains)
subdomain.example.com is in another server and it doesn't have access to session data and database of the accounts system. How I check if the user is logged in is that I get the session ID (as it is available in all the subdomains). Then, I send an HTTP request to the accounts server with the session id and a password (A password that secures HTTP requests).
The HTTP request from subdomain.example.com is as follows.
$sessionId = $_COOKIE[$sessionCookieName];
$post = http_build_query(
array (
'http_secret' => AUTH_HTTP_SECRET,
'session_id' => $sessionId
)
);
$opts = array('http' =>
array (
'method' => 'POST',
'user_agent' => $_SERVER['HTTP_USER_AGENT'],
'content' => $post
)
);
$context = stream_context_create($opts);
$url = 'https://account.example.com/check-login';
$response = #file_get_contents($url , false, $context);
So, an HTTP request will be sent to accounts.example.com/check-login.
check-login.php at accounts.example.com is as follows.
$httpSecret = $_POST['http_secret'];
// if it is from an invalid client
if ($httpSecret !== HTTP_SECRET) {
throw new Exception('HTTP Error');
}
$sessionId = $_POST['session_id'];
# set the session ID
session_id($sessionId);
# then, I get the session data and checks if the user is logged in
If the user is logged in I return the account-related data to subdomain.example.com.
Is this approach is good or bad?
Thanks in advance.

Answer 1

There is no security flaw in it. That is one of the reasons you have the function in the first place.
And if you want your code reviewed, try https://codereview.stackexchange.com/

Answer 2

No, it is not secure, you should use HTTPS for this.