title: Cross Domain Login - How to log a user in automatically when transferred from one domain to another
body: <p>We offer a number of online services. We are required to develop a system which provides a quick/simple experience for users if they are transferred from one service (on <code>domain1.com</code>) to another service (on <code>domain2.com</code>).</p>
  
  <p>Is there a safe and secure way to log a user in automatically once he has been transferred to the new service?</p>
  
  <p>Yell at me if the solution below is completely insecure/wrong.</p>
  
  <p>We were considering a system similar to that provided by a number of online services for password recovery - they are emailed a link with a unique hash which expires, that allows them to change their password.</p>
  
  <p>The <code>domain1.com</code> site would generate a unique hash and store it in a database with the hash linked to a user along with an expire datetime field.</p>
  
  <p>The user will be transferred to <code>domain2.com/auto/?hash=d41d8cd98f00b204e9800998ecf8427e</code></p>
  
  <p><code>domain2.com</code> would next make a request to <code>domain1.com</code> with the hash to get the information about the user. <code>domain1.com</code> would then remove the hash from the database. <code>domain2.com</code> would log the user in and set cookies, etc.</p>
  
  <p>Could something based on OpenID or OAuth achieve the same results?</p>