# Security breach in Discourse forum with SSO

**URL:** https://meta.discourse.org/t/security-breach-in-discourse-forum-with-sso/55759
**Category:** SSO
**Created:** [14 Janeiro , 2017 12:01 UTC](https://meta.discourse.org/t/security-breach-in-discourse-forum-with-sso/55759 "2017-01-14T12:01:32Z")
**Posts on this page:** 1
**Showing post:** 27

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [1 Março , 2017 23:41 UTC](https://meta.discourse.org/t/security-breach-in-discourse-forum-with-sso/55759/27 "2017-03-01T23:41:39Z")

</div>

Email confirmation of backup downloads is now in, thanks to @blake. You can’t download backups simply by being logged in, you must..

1. Be logged in as an admin → to get to `/admin/backups`
2. Control the email address of an admin → to receive the download link email

So this is indeed a form of two factor auth. Verifies control of the email account, _plus_ the ability to log in as the admin. Here’s the actual email the admin will receive when the download backup button is pressed; it warns about unknown attempts to download the site database:

> Here’s the [site backup download](http://example.com) you requested.
> 
> We sent this download link to your validated email address for security reasons.
> 
> (If you _didn’t_ request this download, you should be seriously concerned – someone has admin access to your site.)

Along with the major cookie token security database changes in 1.8, this should make it _much_ harder to have a full DB breach out there, and once it is out there, the damage is considerably less.

---

_[View the full topic](https://meta.discourse.org/t/security-breach-in-discourse-forum-with-sso/55759)._