php - security issue with app loaded within iframe -

i'm working on application loaded inside iframe within other web page. when user launches application got request app one:

www.mypage.com/?user=1234

then app redirects user to

https://login.host.com/oauth2?response=code&client_id=my_app_id&scope=& redirect_url=www.mypage.com/?index/loadapp

given user id used check if there token in db, if not - received code used receive new access token.

question following: how prevent calls aren't going i-frame on www.host.com? request "www.mypage.com/?user=1234" can seen in firebug console, so, if manually enters url in browser, can launch app random user. whats more, if there found such token in db, person see random user data!

i use request signing requests. dont know first request (www.mypage.com/?user=1234).

whats best practice in such cases?

thanks!

your problem is, in essence, site isn't using authentication first request! need come scheme other web page sign request, , verify signature before performing redirect.

(additionally, make sure url that's being redirected performs appropriate authentication well...)