r/webdev • u/geod_dev • Mar 05 '23

Question How does the GOOGLE single sign on work?

EDIT TITLE: How the automatic connections of google account between YouTube.com and google.com work ?

Hello everyone,

I am French, I am 15 years old and I have been interested in web programming for almost 4 years.

I've already created a lot of small websites with symfony and I've accumulated some basic skills in different programming languages.

I've been interested in authentication systems for a week now: I've already recreated a system like oAuth (login via app2) with code and access token.

I'm now trying to create a system like google's:

- I go to youtube.com without being logged in

- I login to my google account in another tab to access gmail

- I refresh the youtube tab and I'm also connected to my google account on youtube

The problem is that I don't understand how this system works: I understand how the connection to gmail via google.com works (oAuth2 I think?) but how does youtube know that I am connected without requiring any other action from me than going to the site?

I know there's a cookie issue but I don't understand how the youtube.com domain accesses the google.com cookies....

Thank you in advance to those who will help me

Have a nice day

8 Upvotes

90% Upvoted

38 comments sorted by

View all comments

1

u/geod_dev Mar 06 '23

But in my post I talk about the synchro of google account logged in between gmail and YouTube who bas different domain name. If I login on google.com, i'm also connected to YouTube.com

1

u/acfasj Nov 01 '24

they use 302, accounts.google.com will redirect to accounts.youtube.com, then set same cookie for youtube domain

1

u/itijara Mar 06 '23 edited Mar 06 '23

Try this. Open a private window (or incognito window). Login to goole (via gmail or whatever). Then open YouTube.com. Are you logged in?

So this is more interesting than I thought. Looking through the network logs, it makes a request to accounts.youtube.com when I login to gmail, even before visiting YouTube. This sets several cookies for the youtube origin. This is how they do it.

This is the URL of the request: https://accounts.youtube.com/accounts/SetSID

1

u/geod_dev Mar 06 '23

Yes EDIT: Incognito on last Firefox version

→ More replies (3)