Universal Login Prompts before FedCM
How do we tell people they can login to a service running on AT Proto, with a AT Proto compatible account they already have?
How might we tell a Leaflet user, the account they’re already logged in to, can be used to login to Tangled, if they don’t know that the Leaflet account they have, is really an AT Proto account under the hood?
What about a shared service? Any AT Proto could call over to this service with a browser cookie, to see if that cookie has been attached to any other DIDs.
How do we check where that request is coming from? Check that AT Proto client’s .well-known client-metadata.json URL
Access-Control-Allow-Origin: https://honks.app
Access-Control-Allow-Credentials: true
Maintain a publicly available list (on a tangled.org repo) that shows the clients on the Access-Control-Allow-Origin list.
Either an iframe, or a small JavaScript shim.
This returns a list of DIDs. It’s up to each client to parse the DIDs, and handle these as they see fit.
Data expires after 7 days (open to feedback). Schema is a lexicon record:
DID Epoch timestamp Origin (URL)
XRPC endpoints
POST /account/logged-in POST /account/logout GET /accounts
Any client wanting to surface “you have previously used these DIDs on this device. Click to use this account for too!”.
Obvious flaws here for privacy - what if this is a shared laptop? Could this be abused? Yes. Should a user be opted in to this automatically on login? Privacy says “no”. Growth says “yes”. We will leave this decision to each client.
Each client should send a DID periodically. Ideally, every few minutes they do something intentional, when the user is active on their client.
This acts as a heartbeat. We don’t store a history of records, instead we store a DID/service key pair, with a “last_seen” epoch timestamp.
Example: when the Bluesky client is reloaded after a day, send the DID.
Example: when a Tangled user has viewed a page, send the DID.
Each client should send a DID to /account/logout when the user logs out of their platform.
Because the data expires after 7 days (eek, is this too long?) the long tail of data is removed from the browser.