Single-Sign-On for embedded comments, v1

Good question. 1) this wll work:

<script>
edCommentsServerUrl='http://...';
edCurrentUserHmacSha256Base64 = 'auw4/25VrFJf81Kn/RN2f1R/auI892XbCsRQYOPA/EU='
edCurrentUser = '{\"externalId\":\"maria_ext_id\",\"emailAddress\":\"maria@x.co\",\"username\":\"maria\"}';
</script>

Here, edCurrentUser is actually a string, representing a JSON object. And the HMAC is generated like so:

const maria = { externalId: 'maria_ext_id', emailAddress: 'maria@x.co', username: 'maria',
    fullName: undefined, avatarUrl: undefined, aboutUser: undefined };
const mariaJson = JSON.stringify(maria);  //  —> the edCurrentUser string above
const mariasHmacBase64 = utils.calcHmacSha256Base64(mariaJson, theSharedSecret);

and: (I wonder if this is understandable, although it's Javascript?)

const crypto = require('crypto');

calcHmacSha256Base64(message: string, secret: string): string {
  const hmacBytes = crypto.createHmac('sha256', secret);
  hmacBytes.update(message);
  return hmacBytes.digest('base64');
}

2) I'm not sure if it's good to support the folowing. it's the same HMAC, generated via JSON.stringify of a user JS object, but the user is here sent to the server as a javascript object instead of a JSON string. This makes it a bit harder to understand how the HMAC is calculated server side, so ... maybe shouldn't allow this? Hmm what do you think?

<script>
edCommentsServerUrl='http://comments-for-e2e-test-embsso-localhost-8080.localhost';
edCurrentUserHmacSha256Base64 = 'auw4/25VrFJf81Kn/RN2f1R/auI892XbCsRQYOPA/EU='
edCurrentUser = {"externalId":"maria_ext_id", "emailAddress":"maria@x.co", "username":"maria"};
</script>

I can update the orig post to clarify how this'll work ... and I'll probably use the JSON string version, i.e. 1) above, or what do you think? Then you need to insert & escape only 1 thing into the generated HTML, rather than an object with many different fields.

(Not sure if this is interesting, but anyway here is the end-to-end test from where I copied the above code snippets.)

I deleted it, sorry. It was old and out of date. (Didn't realize someone would find the link to it :- )) Here's a new:

Oh sorry I forgot, about: "Would this be supported in the hosted or self hosted version anytime soon?" — I'd like to add SSO for both hosted SaaS and self hosting, and for both embedded comments and for the general forum. About soon: Hmm maybe the hardest part is to find someone who can review the SSO things from a security point of view, and knowing that the SSO solution is actually being done in a good way.

With SSO, do you have in mind to completely replace all login methods (including Gmail and Facebook etc) with the one you use right now? Do people login at another page over at your www.yoursite.com main server, or how does it work? ( ... Ok now I had a look at your site, and you have email + Facebook + Gmail login, via your site? Then I imagine you have in mind to completely replace Talkyard's login method, with your own?)

(p.s. I edited your post above and removed the page-not-found image, it's a bit large and maybe not so interesting any longer, since it's just because I deleted the page)