# Security implications of exposed SSO Secret in multi-user install?

**URL:** <https://meta.discourse.org/t/security-implications-of-exposed-sso-secret-in-multi-user-install/29092>\
**Category:** WordPress\
**Created:** [5월 21, 2015, 8:39오후 UTC](https://meta.discourse.org/t/security-implications-of-exposed-sso-secret-in-multi-user-install/29092 "2015-05-21T20:39:00Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![jetatomic](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jetatomic/32/42202_2.png) [@jetatomic](https://meta.discourse.org/u/jetatomic)\
**Post date:** [5월 22, 2015, 5:38오전 UTC](https://meta.discourse.org/t/security-implications-of-exposed-sso-secret-in-multi-user-install/29092/6 "2015-05-22T05:38:54Z")

</div>

Thanks, @purldator. That’s an interesting workaround. I have no idea how to implement it, but I see what you’re getting at and it makes sense.

@riking, That’s what I was afraid of. Thank you for explaining why the secret needs to stay a secret. It’s very helpful to know the risks.

This is beyond the scope of WordPress, but would another potential route be to add a user level sso secret in Discourse–something like to the user API key?

As it relates to WordPress, the cleanest way would be to add better [Network Plugin](https://codex.wordpress.org/Multisite_Network_Administration#Plugins) support. There are a few other settings that make sense to manage network-wide, so perhaps someone with more dev skills than I runs into similar issues.

---

_[View the full topic](https://meta.discourse.org/t/security-implications-of-exposed-sso-secret-in-multi-user-install/29092)._