A method for controlling user access to a protected resource via an untrusted application, in which the method comprises: the untrusted application requesting access for a user to the protected resource at a resource server; in response to an identification, by the resource server, that the request lacks an indication that the user is authorized to access the protected resource, the resource server issuing a redirection command to the untrusted application to cause the untrusted application to open a client browser, the method further comprising: (a) intercepting a request from the client browser directed to an authorization server; (b) requesting user credentials from the client browser; (c) processing user credentials received from the client browser to authenticate the user; (d) redirecting the client browser to the authorization server configured to issue a token credential for indicating authorization of the user to obtain an authorization token for indicating to the resource server authorization of the user to access the protected resource; (e) intercepting an authorization request from the browser to the authorization server, and (f) inserting into the authorization request an HTTP header variable indicating the authentication status of the user, wherein the token credential allows access, by the untrusted application, to the authorization token from the authorization server. the untrusted application requesting access for a user to the protected resource at a resource server; in response to an identification, by the resource server, that the request lacks an indication that the user is authorized to access the protected resource, the resource server issuing a redirection command to the untrusted application to cause the untrusted application to open a client browser, the method further comprising: (a) intercepting a request from the client browser directed to an authorization server; (b) requesting user credentials from the client browser; (c) processing user credentials received from the client browser to authenticate the user; (d) redirecting the client browser to the authorization server configured to issue a token credential for indicating authorization of the user to obtain an authorization token for indicating to the resource server authorization of the user to access the protected resource; (e) intercepting an authorization request from the browser to the authorization server, and (f) inserting into the authorization request an HTTP header variable indicating the authentication status of the user, (a) intercepting a request from the client browser directed to an authorization server; (b) requesting user credentials from the client browser; (c) processing user credentials received from the client browser to authenticate the user; (d) redirecting the client browser to the authorization server configured to issue a token credential for indicating authorization of the user to obtain an authorization token for indicating to the resource server authorization of the user to access the protected resource; (e) intercepting an authorization request from the browser to the authorization server, and (f) inserting into the authorization request an HTTP header variable indicating the authentication status of the user, wherein the token credential allows access, by the untrusted application, to the authorization token from the authorization server.