Hacker News Reader

Comment by appleaday1 | Hacker News Reader

Its like me blocking youtube on hosts file or even on Pihole or related manually. I realize blocking youtube BREAKS a lot of things in the network.

View on HN

What does blocking youtube break, aside from youtube?

There's a YouTube domain that's somehow a load-bearing part of Google's OAuth login flow.

I’ve never understood this (and really would like to). Why on earth does Google redirect to YouTube and then back to Google when logging in…

The only reason I can think of is to sync user session cookies across domains?

I guess it's the same reason I go through 4 login screens whenever I want to login to my Microsoft account... Legacy

Perhaps they want to force companies to not block YouTube.

It's indeed to log you in to multiple Google properties at once. It's not needed for e.g. Gmail (since it's a subdomain under google.com) but YouTube is in its own domain so it has no access to google.com's cookies.

I can confirm: it’s because of the syncing session cookies across domains.

I do believe it works if you block just the youtube.com domain and not *.youtube.com

You already know the reason.

In additional to youtube.com, in many cases, they redirect to many countries specific domain as well (e.g google.co.jp)

Youtube is common enough that they want to login on the same flow

I turned off YouTube for my account using admin.google.com. Doing so causes Google to stop redirecting me to YouTube and back. Of course this also means I'm never logged in while visiting YouTube.

Other than Chrome browsers don't support third party cookies by default.

Yes, I noticed this. Perhaps due to different handling of logins on both the sites. This could be handled in the backend by not redirecting as well, but therd should have been design choices there.

Reply on news.ycombinator.com