Javascript登录浏览器弹出窗口

Question

If I have a different app on x-number of subdomains, it seems easiest to just have login be through the browser/javascript popup. Is this safe? Is it better to do this than server-side authentication? Do you have a little pastie on how to make the authentication popup and pass the info to say Rails?

Answer 1

最好将服务器端身份验证用于诸如托管之类的事情，安全性要复杂得多，并且您可以实现更多的制衡。

Answer 2

I would definitely use server side authentication. There's more flexibility, and its more secure.

I understand the desire to make things easier for the user, but security is one area where safe is better than easy.