Analyze single sign-on (flowchart and data security)

Last year, the company has done a single sign-on module, two sites, colleagues are based on cookies and session to achieve, in that module and no separate user authentication center, each child station has its own login system, in determining whether the user is logged on, The first is to determine whether the user is logged in or not by determining if the cookie exists. If the cookie value exists, the session is written and the login ticket is saved.

The general cookie-based program, to some extent the biggest problem is security, because it is stored as a file in the client. So generally very important information, such as user login information, user's bank card information will not be stored using cookies. Although cookies can be encrypted, But the individual always feel uneasy. For this I have been looking for a security level of the single point of entry program.

Not long ago, I saw this article: Single sign-on (SSO) component design and implementation of one, found that it is based on the session, it was particularly strange, because we know that the session is not across the application, and then carefully analyzed before we know the principle:

According to the idea of the program, I changed the implementation of the flowchart, personal good understanding:

If the Yumbo master saw this picture, also hope that the evaluation under the original thought? I am not particularly experienced in this area, can only understand this, hope everyone advice.

In addition to changing the single sign-on flowchart, I would like to discuss the differences and benefits based on cookies and two ways to implement the session:

In the solution above, federated site to achieve a single sign-on, it is necessary to interact with the certification center, this will be in the Web to pass the user login information, generally include the user name and user login password. This is our biggest concern, because the very important information about passwords is passed on the web.

Dangerous, the main is that there are illegal users to intercept the transmission of information to tamper with user information.

The solution above the original blogger to achieve very good, here I quote the original bar: