- You sign into myaccount.google.com.
- Somewhere along the line your browser is redirected to
https://accounts.youtube.com/accounts/SetSID?ssdc=1&sidt=<reallyLongBase64>&continue=https://myaccount.google.com/intro&tcc=1probably inside an iframe.
- Youtube server sets some cookies.
- You click the youtube icon in myaccount.google.com and you're logged in without following the oauth2 flow.
How can this be achieved?
My best guess is that the
sidt=<reallyLongBase64> parameter is the users id that should be logged in encrypted with a key private to google with an algorithm that takes time into account(so the request wouldn't be repeatable)