Finding about Amazon Prime Login

  UI Backend/Database
primevideo.com server returns Frontend
User goes to primevideo.com and tries to login
1 html for on request to login, user is
 
taken to the amazon.com OAUTH portal
Since primevideo.com depends directly on
2 amazon.com accounts, the user is taken to the  
login page of amazon
At this point the user is on screen with url
something like
“https://www.amazon.com/ap/signin?
accountStatusPolicy=P1&clientContext=262-
0736577-
4321655&language=en_US&openid.assoc_handle=
amzn_prime_video_desktop_us&openid.claimed_i
d=http%3A%2F%2Fspecs.openid.net%2Fauth
%2F2.0%2Fidentifier_select&openid.identity=http
%3A%2F%2Fspecs.openid.net%2Fauth
When server receives credentials from
%2F2.0%2Fidentifier_select&openid.mode=checkid
user, it verifies those credentials and if
_setup&openid.ns=http%3A%2F
3 those credentials are correct It, it return
%2Fspecs.openid.net%2Fauth
a secret id(arb in url) to the
%2F2.0&openid.ns.pape=http%3A%2F
primevideo.com,
%2Fspecs.openid.net%2Fextensions%2Fpape
%2F1.0&openid.pape.max_auth_age=0&openid.ret
urn_to=https%3A%2F%2Fwww.primevideo.com
%2Fauth%2Freturn%2Fref%3Dav_auth_ap
%3F_encoding%3DUTF8%26location%3D%252Fref
%253Dav_nav_sign_in”. see the openid.return_to
value, it’s pointing to the primevideo.com, which is
a way to tell backend, that from which source this
request has come
 
Secret Id recived beyu primevideo.com is
used to create a session against
When the user is successfully sign on the page, the
it primevideo server (not on
user is redirected to primevideo.com with url =
4 amazon.com server) and at same time,
“primevideo.com/ap/return?arb=66bc9e00-a174-
browser stores the cookie for this
434a-a969-af74b1f87442”
session
 
Now a session is created on the
Primevideo.com and cookies related to it
are stored in the browser. There is
And After this the url is changed
persistant login In browser and
5 to https://www.primevideo.com/ref=av_auth_retu
primevideo.com server is using the
rn_redir
session to provide content to the user