#1 Redirect the user to the SSO login page

Check if your user has a valid session using the Session method. If they don't have a session at all, or their session is not valid, redirect them to SSO login page, you can get this url from the LoginUrl method.

Every request made to your server should call the Session method to get the validity of the session.

Make sure to pass in the query string your appcode and url:

auth2.comscore.com?p=[myurl]&a=[myappcode]

Don't forget to begin your URL with https:// and remember to query string escape it

#2 SSO Authenticates the user

#3 The user is redirected back to your site with a JWT token

The user will be redirected back to the url you provided in the query string.

The JWT token will be inside the jwt query string key

https://yoururl.com/?jwt=abcd.efgh.jklm

#4 Process the JWT token

1. Verify the token signature (This is done with the CipherKey (UTF8) provided to you)
2. Verify other claims

   Make sure to verify the JTI to avoid a replay attack, SSO will never send you the same token twice

   The optional ValidateToken method is available if you do not have the ability to validate jti, or other claims.

3. Extract the session key from the sub claim
4. You will find the url of the API for next step in the iss claim

#5 Get the user's information

Call this API's User method to get the user's information (You should only call this method once per session)

To call the API's user method, you will need to form your own JWT token in order to verify your application's identity

The iss claim of the token is your AppCode

The sub claim of the token is the sub (session key) you received from the first token

Sign the token using HS256 and the CipherKey (UTF8) you were given

#6 Establish a local session

1. Save the session key in a cookie
2. Cache the user information server-side

   DO NOT PLACE THE USER INFORMATION IN A COOKIE. Doing this will make your application vulnerable to a user impersonating others and granting themselves unauthorized access rights.

You can also consider creating your own session key in addition to the one given to you by SSO. This allows you to manage your session lifetime at your own whim.

#7 Every request, verify the session with the Session method

SSO has involved session management policies and procedures; make sure the session is still valid every request. The user may have been disabled, or logged in on another computer

See step #1