Re:What Have We Forgotten?
by ffsm8 on Wednesday January 29, 2025 @11:39AM
(#42867291)
> Users are now required to authenticate every time they switch from one single-page application to another, because JWT tokens live only in the context of the JavaScript execution, thus rendering the use of Single Sign-On OAuth 2.0 workflow totally moot.
It seems the author hasn't actually seen a SSO workflow in practice. I'm sure he worked with an oauth server before, but it's implementation wasn't a SSO if the user has to actually do an interaction for the authentication.
Can't really say more without hearing what he thinks a SSO flow actually is. Especially because of how many of them exist. Some of them at the api gateway layer via server set cookies, others reusing the Windows login session etc
It seems the author hasn't actually seen a SSO workflow in practice. I'm sure he worked with an oauth server before, but it's implementation wasn't a SSO if the user has to actually do an interaction for the authentication.
Can't really say more without hearing what he thinks a SSO flow actually is. Especially because of how many of them exist. Some of them at the api gateway layer via server set cookies, others reusing the Windows login session etc