Multiple apps in the same portal

[jliu]

I assume all your SPA apps use the same logic that takes a user to Okta’s login widget. When a user has logged in to Okta from one app, Okta will store a session cookie for that user in the browser. When the user navigates to another one of your apps, since it’s the same browser, the Okta cookie will be sent to Okta by the browser, and OKta login widget will not need to show, since the cookie proved the user has logged in recently. Your second app should/would silently let the user pass authentication since Okta let it pass.

The part about Okta cookie is similar to the other question by the following link, although I understood yours are SPA apps, and the apps in the other question likely use authentication middleware on the server side. But still, the Okta cookie usages are the same.

How is session cookie used to enable SSO?

Since you mentioned creating cookies, I assume app A & B both use the same server-side logic (perhaps middlewares since it’s a common practice) to make sure users are authenticated before they can access protected resources of your apps. When your app uses middleware, there would be a cookie middleware on top of an authentication middleware. The cookie middleware processes the request first. When it sees a valid session cookie issued by your app before, authentication criterion is met, and the …