Preocupación de seguridad/privacidad: Correo electrónico expuesto en la URL de redirección de DiscourseConnect Provider

JACK_ZHANG · 5 Mayo, 2026 08:43

Aquí está el enlace a la PR

github.com/discourse/discourse

FEAT: Add optional email field to DiscourseConnect Provider response (#38382)

main ← Jackzhang144:add-dc-provider-email-option

已打开 06:48PM - 09 Mar 26 UTC

Jackzhang144

+5 -1

Adds a new site setting `discourse_connect_provider_provides_email` (default: tr…ue) to control whether user email is included in the SSO redirect URL. This maintains backward compatibility while allowing admins to disable email exposure for privacy reasons. See: https://meta.discourse.org/t/security-privacy-concern-email-exposed-in-discourseconnect-provider-redirect-url/397980

Tema		Respuestas	Vistas
Setup DiscourseConnect - Official Single-Sign-On for Discourse (sso) Integrations sso , configuring , discourseconnect , how-to	45	455586	28 Enero 2026
Use Discourse as an identity provider (SSO, DiscourseConnect) Integrations sso , discourseconnect , how-to	143	50518	9 Noviembre 2024
DiscourseConnect / SSO. Force users to provide an email after redirecting from the parent website SSO discourseconnect , email	0	309	13 Septiembre 2022
Create a DiscourseConnect login link Integrations sso , discourseconnect , how-to	6	6354	25 Septiembre 2024
Integration into custom auth system where emails are not unique? SSO email	40	1456	6 Junio 2024

Preocupación de seguridad/privacidad: Correo electrónico expuesto en la URL de redirección de DiscourseConnect Provider

Temas relacionados