# Getting signed data from the server

**URL:** https://meta.discourse.org/t/getting-signed-data-from-the-server/95084
**Category:** Development
**Created:** [August 19, 2018, 6:23am UTC](https://meta.discourse.org/t/getting-signed-data-from-the-server/95084 "2018-08-19T06:23:17Z")
**Posts on this page:** 1
**Showing post:** 18

<div class="post-metadata">

### Author: ![fefrei](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/fefrei/32/119538_2.png) [@fefrei](https://meta.discourse.org/u/fefrei)
#### Post date: [August 23, 2018, 6:16pm UTC](https://meta.discourse.org/t/getting-signed-data-from-the-server/95084/18 "2018-08-23T18:16:44Z")

</div>

> [@EGreg](#):
>
> What is the endpoint that I should call from _my_ site in order to get Discourse to return signed data?

Like this (but remember that the roles of _your application_ and _Discourse_ are swapped):

> [@Setup DiscourseConnect - Official Single-Sign-On for Discourse (sso)](https://meta.discourse.org/t/setup-discourseconnect-official-single-sign-on-for-discourse-sso/13045/1):
>
> Discourse will redirect clients to `sso_url` with a signed payload: (say `sso_url` is `https://somesite.com/sso` )
> 
> You will receive incoming traffic with the following
> 
> `https://somesite.com/sso?sso=PAYLOAD&sig=SIG`

> [@EGreg](#):
>
> How do I pass the URL to redirect to, the “state” parameter from oAuth etc.?

You can’t, Discourse will always send the user back here:

> [@Setup DiscourseConnect - Official Single-Sign-On for Discourse (sso)](https://meta.discourse.org/t/setup-discourseconnect-official-single-sign-on-for-discourse-sso/13045/1):
>
> Redirect back to `http://discourse_site/session/sso_login?sso=payload&sig=sig`

From there, you application can redirect the user wherever you want.

> [@EGreg](#):
>
> Does this plugin support oAuth 2 or anything like that, or do I implement a custom handler?

No, it’s a custom protocol.

> [@EGreg](#):
>
> Does it sanitize the redirect, do the latest additions to oAuth 2 like `appsecret_proof` etc?

Since Discourse redirects to a fixed URL to complete authentication, there’s no sanitization going on 🙂

---

_[View the full topic](https://meta.discourse.org/t/getting-signed-data-from-the-server/95084)._