Security/Privacy concern: Email exposed in DiscourseConnect Provider redirect URL

[Falco]

@JACK_ZHANG

The core issue is: we don’t want to expose unnecessary user information (like email) to “third-party sites using Discourse for SSO login”. Users authorize only to prove “I am a legitimate user” - they don’t expect their email to be shared.

I’m curious, what is this downstream third party that has implemented our custom SSO protocol?

@JACK_ZHANG

Would a site setting to control whether email is returned be acceptable?

I’d say that is pr-welcome as long as it is not the default, so we don’t break existing sites.