Securing a website is a necessary evil for a website owner that wants to protect certain data. It is of course possible to arrange this yourself for each website, but the danger exists that there are weaknesses in the implementation. And having multiple websites the risk increases. Especially if a user needs to create a new account for yet another website. And although there are good tools nowadays, it still occurs that too weak passwords are used or the same password for multiple websites. The latter becomes a problem when one website is hacked and the credentials can be used to log on to other websites.
The 'Authentication Service' is a service that, on the one hand, takes care of this task for the connected websites but on the other hand ensures a safe environment for the user to sign in. In fact, the connected websites have no knowing about the authentication process. Because no matter where the user wants to sign in, the sign-in is always done on this website. After signing in, this service only confirms that the user is known and the user's ID is returned. An ID that is unique per website. This means that, in case multiple websites are owned by one owner, it is therefore not possible to to create profiles based on these Id that cover multiple websites. Nevertheless, all the information that the user shares websites may provide leads to differentiate and link users.
In addition to the safer environment, there is another advantage for the user. Only one account is needed to access the connected websites Sign up. And thanks to single sign-on (SSO) it is possible to do this automatically for connected websites. That is, if the user once logged in, the user only has to press the 'Sign in' button of the connected website to sign in. Thanks to a cookie on this website can be identified to the user and the authenticate process will be completed without further interaction. As long as the cookie is there, single sign-on (SSO) works, but once it is gone, for example because it will be erased after closing the browser, it will the user will have to log back in the next time.
Another advantage is that only one account is needed and that creating and erasing is accessible. Only one-time account only asks for a valid email address in order to manage the account. For example, for the "forget password" feature that sends a link to the known email address. And through the management capabilities of this website, the account is just as easy to delete again.
Are you owner of a website and interested in the possibilites of outsourcing authentication and (optional) authorization? Or do you want to start a website and are you looking for a hosting party? Take a look here or contact us with the contact form.
This service is hosted by Procs-IT.