3 ms·
I think for almost all cases, there are simpler solutions: * Use secure cookies (set the secure bit so these cookies are only sent over HTTPS) for authenticati
by byoogle 14y ago
I think for almost all cases, there are simpler solutions:
* Use secure cookies (set the secure bit so these cookies are only sent over HTTPS) for authenticating on your HTTPS site
* Use a separate domain for embeds ("youtube-widgets.com" instead of "youtube.com" on third-party sites)
- mcherm 14y agoThe simplest solution of all is probably to use HTTPS for _ALL_ connections, whether to widgets or to your site. The cost (in encryption overhead) is trivial* and the value is never having to worry about things like this. * - unless it prevents you from using a CDN to distribute images and other static-but-large content. Which it shouldn't, if you do it right.
- patio11 14y agoyoutube-widgets.com still may, depending on product requirements, need to have some notion of your Youtube account credentials. This would, in turn, potentially make youtube-widgets.com into a back door into your Gmail if somebody wasn't careful. (grumble grumble The decision to merge the Youtube and all-powerful-Google* logins was about my least favorite login decision since OpenID $INSERT_HYPERBOLIC_SOUNDING_REFERENCES_TO_BAD_MYTHICAL_EVENTS_ WHICH_WHILE_BAD_ARE_STILL_NOT_AS_BAD_AS_OPENID.