I'm trying to learn about OAUTH and OpenID Connect.
Thus I am investigating my own traffic, listening to Authorization Requests and Grants by checking for required parameters in OAUTH as described in https://tools.ietf.org/html/rfc6749#section-4.1.1 and https://tools.ietf.org/html/rfc6749#section-4.1.2 for the Authorization Code Flow as well as described in section 4.2.1 and 4.2.2 for the Implicit Flow.
Unfortunately, by using the SSO option for Google on joinhoney.com, I am only able to catch the Request, but not the Authorization Grant.
So, while debugging and having a look at the actual request, I can see the following parameters in the query part of the url:
| Parameter | Value |
|---|---|
| redirect_uri | storagerelay://https/www.joinhoney.com?id=auth[censoredID] |
| response_type | permission id_token |
| scope | email profile openid |
| openid.realm | |
| client_id | 705229005811-2fdpup66d8aefq4qs2ru1n8qiosuq4fb.apps.googleusercontent.com |
| ss_domain | https://www.joinhoney.com |
| fetch_basic_profile | true |
| gsiwebsdk | 2 |
Now, to get to the actual question:
Where can I find some specified information about the ss_domain parameter?
I could not find any information in https://tools.ietf.org/html/rfc6749 as well as on https://openid.net/, however when using google, I can find some people using the ss_domain parameter (only without further explanation), so I doubt it is something only used by joinhoney.com.
Would be happy if somebody could bring some light in here!
Thank you!
