# Security implications of exposed SSO Secret in multi-user install?

**URL:** <https://meta.discourse.org/t/security-implications-of-exposed-sso-secret-in-multi-user-install/29092>\
**Category:** WordPress\
**Created:** [2015 年5 月 21 日 20:39 UTC](https://meta.discourse.org/t/security-implications-of-exposed-sso-secret-in-multi-user-install/29092 "2015-05-21T20:39:00Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

作者： ![purldator](https://avatars.discourse-cdn.com/v4/letter/p/bcef8e/32.png) [@purldator](https://meta.discourse.org/u/purldator)\
发布日期： [2015 年5 月 22 日 02:43 UTC](https://meta.discourse.org/t/security-implications-of-exposed-sso-secret-in-multi-user-install/29092/4 "2015-05-22T02:43:04Z")

</div>

The immediate idea that popped into my mind is to have the WordPress plugin see who is currently viewing the plugin settings. If any user credentials don’t match the admin(s) of the attached Discourse forum, then the plugin settings are greyed out or the page won’t load and will throw a 403.

---

_[View the full topic](https://meta.discourse.org/t/security-implications-of-exposed-sso-secret-in-multi-user-install/29092)._