Preocupação de Segurança/Privacidade: E-mail exposto na URL de redirecionamento do provedor DiscourseConnect

JACK_ZHANG · 5 Maio , 2026 08:43

Aqui está o link para o PR

github.com/discourse/discourse

FEAT: Add optional email field to DiscourseConnect Provider response (#38382)

main ← Jackzhang144:add-dc-provider-email-option

已打开 06:48PM - 09 Mar 26 UTC

Jackzhang144

+5 -1

Adds a new site setting `discourse_connect_provider_provides_email` (default: tr…ue) to control whether user email is included in the SSO redirect URL. This maintains backward compatibility while allowing admins to disable email exposure for privacy reasons. See: https://meta.discourse.org/t/security-privacy-concern-email-exposed-in-discourseconnect-provider-redirect-url/397980

Tópico		Respostas	Vistas
Setup DiscourseConnect - Official Single-Sign-On for Discourse (sso) Integrations sso , discourseconnect , configuring , how-to	46	457493	27 Maio , 2026
Use Discourse as an identity provider (SSO, DiscourseConnect) Integrations sso , discourseconnect , how-to	142	51273	9 Novembro , 2024
DiscourseConnect / SSO. Force users to provide an email after redirecting from the parent website SSO email , discourseconnect	0	320	13 Setembro , 2022
Create a DiscourseConnect login link Integrations sso , discourseconnect , how-to	6	6434	25 Setembro , 2024
Integration into custom auth system where emails are not unique? SSO email	39	1618	7 Maio , 2024

Preocupação de Segurança/Privacidade: E-mail exposto na URL de redirecionamento do provedor DiscourseConnect

Related topics