How does youtube sign you in with your gmail account?

Question

I have an idea of how they would do this but it seems very hacky way about going about it.

The problem I see from this is that youtube needs to grab gmail or google cookies.

The way I would do this would be to open another frame from the gmail domain that reads the gmail cookies and forwards this information to a youtube url. This youtube url would then authenticate based on the forwarded information. Like I said before it seems very hacky way about doing this and probably not the way they are doing it.

If anyone knows how they do it or has any other ways to go about doing this I would like to hear it.

Answer 1

Google uses OAuth, a secure API/authorization protocol for various applications, to sign you into various services. Part II of the Beginner's Guide, the Protocol Workflow, has a great overview of how this works.

Answer 2

Also, to put in an less technical way: YouTube actually doesn't sign in with your gmail account. Both gmail and youTube sign in with your Google Account.

Answer 3

If you watch network activity in firebug, you'll see google's login redirecting to http://www.youtube.com/signup?hl=en_US&warned=&nomobiletemp=1&next=/&auth= . This encrypted string likely carries a signed proof of identity from google's auth servers. Youtube then verifies this and sets an appropriate cookie.