Security/Privacy concern: Email exposed in DiscourseConnect Provider redirect URL

[Falco]

@JACK_ZHANG

This email is thenBase64-encoded and included in the redirect URL:
https://target-site.com/callback?sso=<base64_payload>&sig=<hmac_signature>

Decoding the base64 payload reveals the email address in plain text.

@JACK_ZHANG

Or implement POST-based callback instead of GET 302 redirect to avoid URL logging

Isn’t that also encrypted with the shared secret?