Cross Domain Authentication

问题:

I am Curious about how cross domain authentication work? for example. To sign into Orkut.com you need to to sign in via Google.com. So the authentication happens at Google.com and it sets the cookie. So my question now is how does Orkut.com able to read this cookie or authenticate the user with no other information ?

What can possibly go wrong?

回答1:

This link might be helpful.

http://code.google.com/apis/accounts/docs/AuthForWebApps.html

Keep in mind, Orkut is one of the Google services.

OpenID is another solution which actually used in SO.

回答2:

orkut is probably using google's OpenID+oAuth for authenticating users. This means that you probably have a google identitity url stored in your orkut profile, and orkut sends you to google so that you can verify that the users signing in through the browser do indeed own the google identity. If orkut gets verification that you own the identity, then orkut can safely assign you the autentication cookies for orkut.