We have built a Single Sign-on system. A technical requirement is that it has to refer to another web page to login to get the token for the child site.

The current solution is a single point of entry - similar to Google accounts, MSN etc where the user clicks login, enters their credentials and is taken back to the page that they were on before. It has been suggested to use a pop up i-frame instead so the user doesn't leave the page.

What are the main arguments for and against each approach from a user experience perspective?

Disregarding architecture and maintenance reasons, my main concern with the pop up iframe is accessibility for people that have scripting turned off, restricted access or a pop up blocker in place. It is worth noting that many of our customer base are using government computers so it is assumed that there will be a higher percentage of people with these restrictions in place than say people a Facebook modal login system to access a system.

It also has space limitations so the user has less room for validation errors or an explanation of the what they are logging into.


3 Answers 3


I would recommend against using a pop-up unless you feel there is a strong need for it. The "pop-up" paradigm is often inappropriately used on many web pages. The pop-up should be used only when it is very important to maintain the user's context outside of what you are doing.

There are two styles of login. Either you have "login-as-navigation" where clicking on the login not only validates your credentials, but also takes to another area which is only available to authenticated users. If your application uses the "login-as-navigation" then it almost certainly should not use a pop-up: the context is changing and there is no value, and possible confusion, in making a pop-up. The other style is "login-as-exposing-capabilities" where you are on a page, and logging in leaves you in the same place, but more capabilities are exposed to authenticated users.

If you have "login-as-exposing-capabilities" a case might be made that the user sees they are on a particular page, and logging-in is a relatively small change of state. A pop up makes it clear that after logging in they will remain on the same page. But how valuable is this? Logging-in is a distinct and separate interaction, and generally a user does not need to see the page (underneath the pop up) to log in. The advantage of clearing the screen and presenting a solitary log-in box is that is it entirely clear to the user that this needs to be done. I would say it probably depends upon the specifics of the site, but there is no general benefit of one way or the other.

What generally drives this is more technical/security reasons than usability. My experience has been that such pop-up mechanisms cause compatibility problems with browsers, with the particular mode of the browser, and with other scripts. I have seen pages that fail to completely refresh to match the new authentication state -- part of the page reflecting a logged in state, while another reflects the anonymous state. These are bugs, to be sure, but you are opening yourself up to these bugs if you expect to load a page that must transform itself between authenticated and non-authenticated mode. Since authentication is a key part of security, a bug with this capability is particularly dangerous.

Given the tradeoffs, I would choose to keep the authentication as simple and clear as possible, navigate to a screen that only does authentication, and then navigate back to a screen that is rendered while your authentication state (and user id) is well known and stable. The slight advantage of usability of a pop-up does not out-weigh the dangers.


I'm sure it depends what branch of government, but I can comment from personal experience, when in the Air Force (I've only been out for a year) we were only allowed to use IE (other browsers would not install).

All active X, and some Java was disabled, and popups were blocked by default, even on .gov or .mil sites. However, there would be a notification that popups were blocked and you would manually have to allow the pop up.

So with this in mind, I would recommend you design with IE 9 and up in mind (several computers were still on XP) and avoid iFrame and JQuery popups.

Addition: I just had a thought. Instead of a popup, or redirecting to another page, design a login bar that is present at the top of all the pages on the site for non-logged in users.

  • 1
    If you are designing for XP support you should support back to IE7, really. IE9 doesn't work on XP; XP can only get IE8. See this: windows.microsoft.com/en-US/internet-explorer/products/ie-9/…
    – cegfault
    Commented Jan 10, 2013 at 1:03
  • Thanks for the responses. I'm of the personal viewpoint of having it as accessible to all. I feel like popup iframes cross the line of an interaction influencing a technical requirement. We currently have a bar at the top but a call has to be made to the secure website to get the token to enable the child site to be logged in.
    – brakes
    Commented Jan 10, 2013 at 14:53

In cases such as yours, the real question is whether this type of functionality is appropriate for your audience.

I believe it's better to go through the small inconvenience of going to a separate sign in page than not being able to sign in at all. It seems too high of a cost.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.