Hacker News Reader

Will bitbucket.org sending me to oauth.atlassian.com fail with Total Cookie Protection enabled ?

Will someonlineshop.com redirecting me to payments.mybank.com fail with Total Cookie Protection enabled because the payments site uses cookies to store the return url for the online shop ?

View on HN

With oauth probably not since the state doesn't transfer with cookies. You send the user to the IdP with a postback in the URL then when the user logs it it sends them back to the original site with some data that depends on the flow you chose.

Your login cookie as far as the IdP is concerned lives on oauth.thirdparty.net and on a successful login the app issues you your own session token that lives on myapp.com.

I believe they maintain a whitelist for the big guys.

Reply on news.ycombinator.com