Design thinking of cross-domain single sign-on in B/s system

Based on B/S system Single sign-on

Here is the concept of single sign-on, that is, different systems common one login interface. A system is authenticated by login, and each system that is connected is logged in. There are generally two scenarios:

1) First-level domain name is the same

For example: Tieba.baidu.com and www.baidu.com

The solution to this situation is very simple. It is in the unified login page after the successful login, the user's token (shared session) information in the cookie, and the scope of the cookie is set to a domain name, for example, set to Baidu.com. This enables the sharing of user login information with the same browser.

2) The first level domain name is not the same

such as bbs.gamename.com and www.public.com

Suppose this scenario, the public official website of some of the game BBS login to access the Public official Website Login Center.

The problem with this scenario is how public will return the user's token information to the BBS after the user has logged in to the public login center. How to solve this problem because different domain names can't share cookies?

Here is a simple idea. Such as:

1th Step Jump:

BBS jump before need to be a GUID and deposit Cookie;guid the recommended 10-bit random number.

The login address is as follows:

http://www.public.com/user/login/?sourcepage=http://bbs.gamename.com/&guid=1393919365

The registered address is as follows:

http://www.public.com/user/register/?sourcepage=http://bbs.gamename.com/&guid=1393919365

The 2nd Step Account Center verifies the login state.

3rd Step Verification Results:

The public server validates the request and logs the login logic. Using RSA private key encryption string to get Loginfo:

4th Step Jump:

The URL parameter returns an encrypted string in the following format:

http://bbs.gamename.com/?loginfo=xTfeKYTQ492DPVEKLdPsdVEJ9Z0B3L45ILTlK/IdOe30A1U+5+/9ScTLt99SvTGHylRGKNTs95/ isx6qmr2dlnuyilo8mecsdx4j15potxfobqwbf83rm9usdylzs19tqv/s1x/tlawwqhj9oq2blauc3k8dbnfqagmsptsot+w=

5th Step Login Verification:

Call the BBS server interface, pass in Loginfo and local Guid,bbs server public key decryption Loginfo, verify GUID consistency. If consistent, the account information will be logged in, and return the results of the login.

Among them, after the Loginfo string decryption information includes:

Parameter name	Describe
Uid	Game Center returns the user platform ID.
Token	Platform Session Token
Nickname	Nickname
Guid

6th step

The BBS server renders the rendering back to the client based on the login verification results.

Design thinking of cross-domain single sign-on in B/s system