Sending session tokens through passive clients

A computer system comprising:

• at least one processor;
• and
• memory comprising instructions stored thereon that when executed by at least one processor cause at least one processor to perform acts comprising:
• sending a first session token to a first computing service from a second computing service;
• the second computing service receiving from a passive client a message comprising a second session token that is purported to match the first session token, the message indicating that a profile is authorized to use the first computing service;
• the second computing service verifying that the message is valid, the verifying that the message is valid comprising verifying that the second session token matches the first session token;
• and
• in response to the second computing service verifying that the message is valid, the second computing service authorizing an identity corresponding to the profile to use the second computing service.

One or more computer-readable storage media having computer-executable instructions embodied thereon that, when executed by at least one processor, cause at least one processor to perform acts comprising:

• a first computing service requesting a proof token from a second computing service;
• the first computing service receiving the requested proof token and a proof key from the second computing service, the proof token being opaque to the first computing service;
• the first computing service signing a set of additional data with the proof key, the set of additional data comprising a profile identity token indicating that an identified profile associated with a passive browser client is authorized to use the first computing service;
• the first computing service including the signed set of additional data and the proof token in a message;
• and
• the first computing service sending the message over a computer network and through the passive browser client to the second computing service, the sending of the message through the passive browser comprising the first computing service identifying the second computing service to the passive browser and instructing the passive browser to send the message to the second computing service.