2

In Facebook for example, when I want to reset my password the website provides several options, one of them is just to login to my email in another tab in the same browser window then Facebook lets me to create a new password.

I want to know how this technique works.

enter image description here

  • 1
    google sets a cookie when you login, facebook can then use that by pinging for it in the background using google's auth api – dandavis Aug 18 '16 at 2:13
1

This is called social login.

Basically, facebook redirects you to google with a callback URI. Once on google you authorize facebook to access your basic information (email and name) and google redirects you back to facebook (to the callback URI from before) with a code.

Facebook then contacts google to exchange that code for a token it can use to access your information. If it can access your information on google, and the information matches the expected information, it has successfully authenticated you.

This is an overly simplified view of the process, there are some crucial steps and precautions that must be taken to make this secure.

The current state of the art protocol for social login is OpenID Connect which works on top of OAuth2.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.