Although outdated, not time to experience, excerpts from someone else's article, pretending to understand the passport
Microsoft has been using Passport authentication for the past authentication service, but it is a software architecture introduced by n years ago, and of course used by many parts of the software industry to break up ebay and passport in 05 due to many security issues and privacy issues. In succession, many companies have also parted with Microsoft's authentication services. Why is it so? This has to be said from the passport process:
Passport is a Cookie-based authentication service. A sample transactional dialog that uses Passport authentication works as follows:
- The client makes an HTTP GET request to a protected resource, such as http://www.contoso.com/default.aspx.
- Check whether the customer's Cookie has an existing Passport authentication ticket. If a site finds valid credentials, the site authenticates the customer. If the request does not include a valid authentication ticket, the server returns status code 302 and redirects the customer to the Passport logon service. The response contains a URL in the query string that is sent to the Passport sign-in service to direct the customer back to the original site.
- The client performs the redirect operation, sends an HTTP GET request to the Passport logon server, and then transmits the query string information from the original site.
- The Passport logon server provides a login form to the customer.
- The client fills out the form and uses Secure Sockets Layer (SSL) to send the POST back to the logon server.
- The logon server authenticates the user and redirects the customer back to the original URL (http://www.contoso.com/default.aspx). The response contains an encrypted Passport Cookie in the query string.
- The customer follows the redirect and requests the original protected resource again, this time using the Passport Cookie.
- The passportauthenticationmodule on the originating server detects the presence of a Passport Cookie and tests for authentication. If successful, the request is authenticated.
"Passport" Microsoft outdated technology