<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Nov 11, 2013, at 11:28 AM, Lloyd Hilaiel <<a href="mailto:lhilaiel@mozilla.com">lhilaiel@mozilla.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><meta http-equiv="Content-Type" content="text/html charset=windows-1252"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">On Nov 9, 2013, at 3:39 AM, Chris Karlof <<a href="mailto:ckarlof@mozilla.com">ckarlof@mozilla.com</a>> wrote:<br><div><blockquote type="cite"><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">But we *are* building a SSO system. I argue we need .onlogout() or something similar to it to notify relying Mozilla services when the user has logged out. </div></blockquote><div><br></div><div>Concrete use cases?</div><br></div></div></blockquote><div><br></div><div>To be clear, I'm not arguing specifically for .onlogout(). I'm arguing for a high level behavior (SSO) that has a "as loosely coupled as possible" implementation.</div><div><br></div><div>Here are some logout "use cases", maybe not all of them MVP:</div><div><br></div><div>Terms:</div><div><br></div><div>MP: Firefox Marketplace</div><div>WMF: Where's My Fox</div><div><br></div><div>1) A user has MP and WMF open in different tabs. The clicks "logout from my FxA" in MP. Ideal behavior: the logged in state on the WMF tab should switch to "logged out" and be signaled in the UI. </div><div><br></div><div>2) A user logs into her FxA from MP, interacts with MP, closes the tab. The user opens WMF, interacts with it, logs out of her FxA. She then opens MP. Ideal behavior: MP should be in the logged out state.</div><div><br></div><br><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div><blockquote type="cite"><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">If there are issues with .onlogout() not working well, we should address those issues, but I think we "want" it.</div></blockquote><div><br></div></div></div></blockquote><div><br></div><div>Again, I misspoke. We need a way to signal to relying Mozilla services that the user has logged in and logged out of her FxA. This may or may not be via .onlogout() on the Watch API.</div><div><br></div><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div><div>We want it in persona too, but it can’t be reliably implemented - this was the conclusion we (dan, sean, shane, myself, etc) came to. It would be useful to challenge this belief with a holistic review of client storage mechanisms and their behavior under default and user configurable privacy properties. We have so much of this knowledge spread across our teams and in issues, a blog post or article gelling it all together would be really fantastic. </div><div><br></div><div>If such an endeavor were timeboxed and quick, this could contribute meaningfully to others in similar positions.</div><br></div></div></blockquote><div><br></div><div>Note that we have more flexibility than Persona because we are running the services relying on this state management. For example, all our services could run on the same second level domain (e.g., *.<a href="http://firefox.com">firefox.com</a>). Or not (<a href="http://webmaker.org">webmaker.org</a>). </div><div><br></div><br><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div><blockquote type="cite"><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">An alternative I've heard is "session cookie assassination", where FxA kills the session cookies of relying Mozilla services on logout. IMO, this is more fragile approach and is insufficient.</div></blockquote><div><br></div><div>Where precisely do you perceive fragility?</div><br></div></div></blockquote><div><br></div><div>IMO, it's too tightly coupled. E.g., It makes it difficult for services to change how they manage sessions without breaking legacy clients. Plus it doesn't work on all browsers.</div><br><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div><blockquote type="cite"><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"> I'm not sure how to accomplish this across multiple domains without UA support, and FxA has to work everywhere (i.e., non-Firefox browsers).</div></blockquote><div><br></div><div>Our approach with persona was to implement the maximum set of features we could reliably implement everywhere (goldilocks), and then gracefully upgrade when UA support exists.</div></div></div></blockquote><div><br></div><div>This doesn't seem acceptable as a cross-browser strategy for FxA SSO. If Google can have SSO for its properties without user agent support, so can we. If a JS ambassador API isn't the right approach, we should find another one. </div><div><br></div><div>Google's approach doesn't seem to be terribly elegant or loosely coupled (mostly on *.<a href="http://google.com">google.com</a>, uses domain cookies on <a href="http://google.com">google.com</a>, uses redirects and explicit state creation on login to transfer session to <a href="http://youtube.com">youtube.com</a>). I hope we can do better, but maybe not or maybe we shouldn't try to do better. I'm still digging in, and suggestions for a simple cross-browser solutions are welcome.</div><div><br></div><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div><div>There are extensive threads around goldilocks in dev-identity (I actually was *really* reluctant to give up on onlogout, it took some conversation and convincing, and now I’m a convert).</div><div><br></div></div></div></blockquote><div><br></div><div>I'll try to dig in to those. </div><div><br></div><div>-chris</div><div><br></div><div><br></div><br><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div><div>lloyd</div><br><blockquote type="cite"><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">Thoughts? </div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><br></div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">-chris</div></blockquote></div><br></div></blockquote></div><br></body></html>