5

The question is admittedly a bit leading, but what I mean to ask is:

If a user logs into into site X, is there a way to automatically log into site Y? Site Y utilises single sign-on via OAuth2 service on site X, so a login via site Y would log you into site X, but not vice versa (that is, login via site X would not give you a session/cookie for site Y)

Let's say I want to minimize the barriers for login, so if I can get a user authenticated into site Y without a single dialog, confirmation, or popup, that is ideal.

Take for example, Stack Exchange. How do they log you in automatically if your session cookie for Programmers SE has expired, but not the cookie for StackOverflow?

e.g. This!


One "solution" I thought of was:

Site X is configured to allow site Y authorization with an implicit grant, so users will no longer have to acknowledge authorization. Upon login via site X, open a hidden/invisible modal to siteY.com/oauth, which automatically authorises the user and saves a session cookie. Upon travel to site Y, user is simply continuing their session, as the cookie was created earlier.

Does that make sense?

1

We created the same feature using oAuth2. Probably use the method as what Site Y is using to automatically login to site X. Try to create an end point on Site Y where Site X can pass an accessToken. Then Site Y will validate the accessToken being passed by Site X if accessToken is valid then create a session. Hope this helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.
{"cc_re__cc_re__cc_by_sa_3_0": ["<li class=\"-item\"><a href=\"https://www.facebook.com/officialstackoverflow/\" class=\"-link\">Facebook</a></li>\r\n                    <li class=\"-item\"><a href=\"https://twitter.com/stackoverflow\" class=\"-link\">Twitter</a></li>\r\n                    <li class=\"-item\"><a href=\"https://linkedin.com/company/stack-overflow\" class=\"-link\">LinkedIn</a></li>\r\n                </ul>\r\n\r\n                <p class=\"mt-auto mb24\">\r\nsite design / logo &#169; 2019 Stack Exchange Inc; user contributions licensed under <a href=\"https://creativecommons.org/licenses/by-sa/3.0/\" rel=\"license\">cc by-sa 3.0</a>\r\n                            with <a href=\"https://stackoverflow.blog/2009/06/25/attribution-required/\" rel=\"license\">attribution required</a>.\r\n                    <span id=\"svnrev\">rev&nbsp;2019.8.20.34639</span>\r\n                </p>\r\n            </div>\r\n        </div>\r\n\r\n            </footer>\r\n            <script>StackExchange.ready(function () { StackExchange.responsiveness.addSwitcher(); })</script>\r\n    <noscript>\r\n        <div id=\"noscript-warning\">Software Engineering S"], "copyright__copyright__copyright": [" oAuth2. Probably use the method as what Site Y is using to automatically login to site X. Try to create an end point on Site Y where Site X can pass an accessToken. Then Site Y will validate the accessToken being passed by Site X if accessToken is valid then create a session. Hope this helps.\n\nYour Answer\n\nBy clicking \u201cPost Your Answer\u201d, you agree to our terms of service, privacy policy and cookie policy\n\nNot the answer you're looking for? Browse other questions tagged or ask your own question."]}