4 ms·

It's SSO, which communicates via tons and tons of redirects

reaperducer 3y ago
It's SSO, which communicates via tons and tons of redirects Not always. AT&T goes through about 25 redirects to sign in. No SSO involved.
- pdntspa 3y ago
  Are you sure?
- nullindividual 3y ago
  It's SSO behind the scenes between services within ATTs environment. It's just not "SSO" to you, the end user.
Nextgrid 3y ago
That's not really an excuse - you really only need 3 page loads: * initial page provided by the service you're logging into - this gets your email address so it can lookup your account and determine which SSO provider to redirect to * actual login page served by your SSO provider - here you authenticate to the SSO provider. It can occasionally cause another page load to get your 2FA code if configured, or go through further identity checks * final "page" that consumes the query parameters sent back by the SSO provider - this is often just a 302 redirect to the home page but sets a session cookie. The main problem is that all these pages are super bloated, with tons of unnecessary JS and BS. All the code for login page that takes a username and password should be able to fit entirely on an A4 sheet of paper - it's literally just an HTML form and a few lines of CSS. Furthermore, even beyond inter-company SSO, there are shitty companies out there which use such flows internally even though everything is part of the same security domain, hosted on the same infrastructure and thus can be hosted on the same top-level domain and use a single session cookie. Microsoft is a pretty bad one - Teams for example will use a redirect to some other Microsoft-owned domain to get your (already existing) Office 365 session; this is completely unnecessary, they can host all those things on the same top-level domain and reuse a single session cookie seamlessly.
- Sohcahtoa82 3y ago
  This is the correct answer. If anyone thinks you need more redirects than this, I'd really like to know what more you think is necessary.
  - phist_mcgee 3y ago
    Because we never decommissioned the old auth server fully and we have to serve some of the page on a separate domain. Oh and the landing page URI has changed. Also we need to send you to a certain locale. And on and on..
JohnFen 3y ago
I never use SSO mechanisms, but I see this same problem.
- Peanuts99 3y ago
  The app still needs to check if your email is using SSO or is federated. And even then some apps use internal SSO to tie different systems together.

It's SSO, which communicates via tons and tons of redirects Not always. AT&T goes through about 25 redirects to sign in. No SSO involved.

pdntspa 3y ago
Are you sure?
nullindividual 3y ago
It's SSO behind the scenes between services within ATTs environment. It's just not "SSO" to you, the end user.

Nextgrid 3y ago

That's not really an excuse - you really only need 3 page loads: * initial page provided by the service you're logging into - this gets your email address so it can lookup your account and determine which SSO provider to redirect to * actual login page served by your SSO provider - here you authenticate to the SSO provider. It can occasionally cause another page load to get your 2FA code if configured, or go through further identity checks * final "page" that consumes the query parameters sent back by the SSO provider - this is often just a 302 redirect to the home page but sets a session cookie. The main problem is that all these pages are super bloated, with tons of unnecessary JS and BS. All the code for login page that takes a username and password should be able to fit entirely on an A4 sheet of paper - it's literally just an HTML form and a few lines of CSS. Furthermore, even beyond inter-company SSO, there are shitty companies out there which use such flows internally even though everything is part of the same security domain, hosted on the same infrastructure and thus can be hosted on the same top-level domain and use a single session cookie. Microsoft is a pretty bad one - Teams for example will use a redirect to some other Microsoft-owned domain to get your (already existing) Office 365 session; this is completely unnecessary, they can host all those things on the same top-level domain and reuse a single session cookie seamlessly.

Sohcahtoa82 3y ago
This is the correct answer. If anyone thinks you need more redirects than this, I'd really like to know what more you think is necessary.
- phist_mcgee 3y ago
  Because we never decommissioned the old auth server fully and we have to serve some of the page on a separate domain. Oh and the landing page URI has changed. Also we need to send you to a certain locale. And on and on..

JohnFen 3y ago

I never use SSO mechanisms, but I see this same problem.

Peanuts99 3y ago
The app still needs to check if your email is using SSO or is federated. And even then some apps use internal SSO to tie different systems together.