3 ms·
SSO really doesn't need cookies to function, you can e.g. pass short-lived authentication tokens via URL hash fragments, that is already supported by OAuth 2.0
by ThePhysicist 6y ago
SSO really doesn't need cookies to function, you can e.g. pass short-lived authentication tokens via URL hash fragments, that is already supported by OAuth 2.0 via the implicit grant flow (and for API-based flows it's not a problem).
- twodave 6y agoIMO this and referrer URL are the only information that ought to be able to be shared between two different domains via the browser. Either put it in the query string so the user can be aware of it or leave it alone. Of course, there are downsides. Query string character limits constrain what can currently be passed (some would say a it's good thing in this context), and browsers are headed more and more towards showing only the domain in the address bar by default. The other remaining problem would be tracking via XHR. The only mechanism for limiting which servers an XHR request can talk to currently is CORS, and that config is controlled by the server, not the user.