0

I have written a small widget application which communicates with an API to create and account and login. This needs to be embedded within a client's page to add our functionality.

This works fine, and I can store credentials for the API in localstorage or cookies.

What I am unsure of how to do is keep our end-users logged in over multiple websites?

The idea is that they will keep their authenticated state so our service can continue to work wherever they encounter it. Does anyone have any experience doing something like this?

userqwert
  • 2,193
  • 5
  • 28
  • 50

1 Answers1

1

Why does the cookiemonster not work?

Cookies and LocalStorage are not meant to be used cross domain, so the plugin or website using your widget will have to (the first time the user enters) log in. The credentials cannot (and should not) be visible cross domain.

How to use the same Cookies / LocalStorage cross domain

The user will at some point be asked to authenticate to your web API, with for example a username and a password. The token you return (credentials) can be set to the same token on all the sites that person is using.

Say user x comes in and ask your API for a token. Your API returns the token token123. User x now opens a new window and again asks for token with the same username and password. Your API will now see that x already has a session, and will return token123 again.

When user y comes along and ask for a token with a different username and password, the API returns token345 and stores it on the client side.

The tokens will be stored in LocalStorage or as a Cookie, so that the client can check if the user already has a token, or if it needs a new one from the API.

As for security

I would highly suggest for your users sake that you use a well used and defined method of authenticating users and send tokens. The best way would be to implement methods such as Microsoft Azure Active Directory, or Google Sign-In (There are multiple well used technologies out there). Storing tokens on your own server is not something you want to be doing. At least not passwords for users.

Thomas Darvik
  • 748
  • 7
  • 22
  • Thanks this is very helpful. I think what I am trying to do is outlined here https://stackoverflow.com/questions/3342140/cross-domain-cookies for anyone that comes across this. – userqwert May 06 '18 at 21:09
  • Correct. If my answer was satisfying, please mark my answer as accepted. If you have any other questions, feel free to ask. – Thomas Darvik May 06 '18 at 21:11
  • I have updated the answer with some headlines, to better explain my points. – Thomas Darvik May 06 '18 at 21:16