'Is sso (single sign on) without redirection good?
I built a sso server sso.mydomain.com. The common sso implementation is to redirect users to the sso server to login then redirect back. But is it simpler to ajax login on sso server? And it is confusing that users see the different domain when login.
Is there any problem to allow javascript ajax to sso server for authentication?
Solution 1:[1]
If I go to example.com and use SSO to login using my Google account, then I get redirected to Google, enter my Google credentials there, and Google can tell example.com that I am who I say I am as it redirects me back.
To do that with Ajax I would need to give my Google credentials to example.com… and then example.com can take my Google credentials and use them to access all my Google data and every other service I use Google for SSO.
So no, it isn't good.
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|---|
| Solution 1 | Quentin |