I have a scenario where the user must authorize with two separate third-party apps (via oauth) in order to proceed. The question arises between successful authorization from the first app, and before attempting to gain authorization from the second app.
I see three options:
- When the first oauth flow is complete, display a button/link to begin the second oauth flow.
- When the first oauth flow is complete, display a button/link to begin the second oauth flow, paired with a message along the lines of
I see some tradeoffs here:
- Requires one more click, but is explicit about what is happening.
- Usually results in one less click, but a flash of content (redirection message and the button/link).
window.location.href='foo'is pretty safe, but you never know what the browsers of tomorrow will do)
I'm leaning towards #3 being the cleanest, depending on web standards, etc. However, I'm concerned that it may cause accessibility issues that I haven't thought about.
The authorization flow for each external app requires user interaction, on the level of signing into their account for that app, reading a list of permissions, and clicking a button.
No user interaction is inherently required in between, but it may be confusing to be looking at
Do you want to allow app X to perform action Y on your StackExchange account?, click
OK, then immediately be faced with
Do you want to allow app X to to perform action Z on your Discus account?.