3

I am frequently seeing websites that allows a user to log-in to their site using other websites log-on credentials. If there is a page that allows me to log-in using my google account or facebook account, will the former site could get my google/facebook login details?

  • If the domain that you enter your credentials on is that of your account (e.g. Google), then your credentials are only going there (i.e. to Google). If however, there is a form on the site you want to log into and it asks for your Google credentials then these will be going to the site in question that could be storing them or misusing them. – SilverlightFox Jan 23 '15 at 9:57
2

Sites like Google and Facebook implement protocols such as OAuth to accomplish what you describe and what is known as Delegated Authorization.

In short, the answer to your question is no. Sites that allow you to sign in with your other accounts never see your account credentials. In simple terms, Google / Facebook are creating a limited use token that links you to your account that may be used to access some of your information on Google / Facebook. Typically, it goes like this:

  1. The client (other website) obtains a token from the server (Google for Example)
  2. The client requests authorization from the Resource Owner (you)
  3. The resource owner validates the request and grants authorization.
  4. The client exchanges the request token for an access token.

There are different methods (flows) that achieve this same principle. You can read more about it here:

http://oauthlib.readthedocs.org/en/latest/oauth2/grants/grants.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.