Ember-simple-auth: Multiple SPA's with shared session

[brunowego]

First, I apologize for the S.O. type question. ✌️

My project have multiple SPA's, one for login, another for administration, and so for. My backend is in Rails 5 with JWT.

I have doubts about how share authentication with different SPAs (Like a SSO). At this moment I need authenticate again when change for another SPA.

Do you have any tips for me? Any experience with such cases is welcome!

[josemarluedke]

Hey @brunowego! So, it is possible to do such thing, I have two different apps that share the same session.

I accomplished that by using cookie for my session store (more here). If your apps are in different subdomain, you need to make sure to share your cookies between the domain. In my apps I made sure to set the same cookieName in both applications. Now for the authorizer authenticator, if you have a custom one, you also need to make sure they are with the same name.

This should be enough to share the session between different apps. Let me know if you have any other questions. Also feel free to hang out at the Ember Community Slack and ask for questions there.

[brunowego]

Thanks for share your experience, at this moment I am testing Ember Engine to see if solve my necessity. If this approach work, I will tell you soon as possible!

[marcoow]

Closing this as @josemarluedke gave a great answer already.

Only one small correct: I think instead of _"authorizer"_ you mean _"authenticator"_ (which needs to be the same and have the same name for both apps).

[villander]

@marcoow and @josemarluedke i have another question about this.

How do set of a cookieName to two apps in differents domains....example in mode development

App1: http://localhost:4200
App2: http://localhost:4300

I can do this via localstorage too?

[marcoow]

@villander: localStorage as well as cookies are isolated per origin which officially includes the port number. I think in the case of cookies many browsers don't actually enforce the ports to be identical but I'm not sure whether you can bet on that. For localStorage I actually don't know - you'll just have to try.

The good thing is trying this out is easy though - simply run

document.cookie = 'test=val';
localStorage.setItem('test', 'val');

in a console on one origin and check whether the data shows up in a window on the other origin.

Whenever you can share data this way, ESA will be able to share the session.

[villander]

What I mean is that I have multiple apps using ESA, and I need to share the session in different domains ... if I do deploy to a nginx server ... the domain will be the same. But developing / localhost does not ... because every app has a different port.

If you can help me @marcoow I would like to know how I can do to share the login between several apps using ESA, I centralize the login only in an app, and I share the token via localstorage? Or do I need to use ESA in all apps?

[marcoow]

You can only share the ESA session if the apps run on the same origin. If browsers allowed sharing client-side data among different origins that would be a huge security risk and therefore isn't allowed.

[villander]

Yeeeah @marcoow
So...the better way of have multiple apps that share same ESA session running in my machine is with nginx installed local or with staging environment where the domain is a same although the ports are different

[marcoow]

Yeah, you'll probably have to have some sort of Nginx setup.

As I said above I think browsers don't actually enforce the complete origin including the port number to be the same for cookies so you might be able to share cookies between localhost:4200, localhost:4201 etc. although that's not officially allowed.