There are a number of methods that would allow SSO between HxF and the site that would not involve any additional security implications as all the authentication would be still provided by HxF. You could either come up with your own system or use existing standards. Could be really quite simple as well, just off the top of my head something like this could work:
- Habbox.com redirects to HxF.
- User is either logged in on HxF or is prompted to login
- HxF generates a message containing username and other relevent details along with a timestamp
- HxF generated a HMAC of the message using a private key
- HxF returns the user with the message + signature to Habbox.com
- Habbox.com checks timestamp is within a certain time and validates the signature of the message using the private key
You could add additional security by including the IP + User agent of whoever successfully completed the authentication on HxF with the message.



















