Hacker News new | ask | show | jobs
by judge2020 1701 days ago
Biggest problem with this would be broken password managers.
1 comments

Wouldn't be a problem if auth is still handled on ycombinator.com
That introduces a problem where certain browsers ask the user to confirm the cross-domain interaction before proceeding (which I suppose mitigates various silent credentials theft and tracking problems) unless you do whole-page SSO, in which case you end up with cookie, anti-tracking, and container-routing problems.
What browser prompts for permission to follow a redirect? OAuth flows don't require cross-domain interaction in any of the ways that browsers have fought to reduce.
Redirects are fine as long as no container-type things are in play (since those don't necessarily carry the origin's cookies across the boundary), it's embedded cross-domain auth forms in an iframe that can cause a dialog.