Is using a long string in a GET variable a secure way of identifying a user?

I am making a Twilio app. Twilio can send a request to the server after a call is over, but it isn't able to be associated with the logged in user of my website because Twilio is making an independent request. If 开发者_开发问答I were to tell Twilio to post something at

example.com/response.html?token=ba38pgab38g4agdusoehle8qihxs&data=somedata

and then use this token as a way of verifying that this Twilio request is associated with a user, is that secure?

I have seen this technique used before on password reset forms. An email will contain a link, and the user's identity is confirmed only using the token.

Is doing this in my Twilio app secure? Are there any gotchas to note?

---

It's as secure as any other request to your server from a remote HTTP client (like a browser). If you want to make sure that no one between Twilio's servers and yours can read the request, you should use HTTPS/SSL.

For this use case, it's probably better to associate the CallSid value that's sent with every request to your server with the user in your system. When the StatusCallback for a completed call fires, look up the user associated with that call and act accordingly.

---

A few of the browser-based single sign on protocols like OpenID and SAML use a similar technique to track state when redirecting between the site you're trying to authenticate to and the site doing the authentication. I think the technique is good enough for what you want to achieve.

I'm not familiar with Twilio, but I'd be careful about using to identify a user though. Generating a unique code (aka nonce) for every request and having Twilio pass that nonce back in the response would be more secure, as it only identifies a particular request. It might be overkill though.