Security/Privacy concern: Email exposed in DiscourseConnect Provider redirect URL

JACK_ZHANG · May 5, 2026, 8:43am

Here is the link to the PR

github.com/discourse/discourse

FEAT: Add optional email field to DiscourseConnect Provider response (#38382)

main ← Jackzhang144:add-dc-provider-email-option

closed 02:16AM - 23 May 26 UTC

Jackzhang144

+5 -1

Adds a new site setting `discourse_connect_provider_provides_email` (default: tr…ue) to control whether user email is included in the SSO redirect URL. This maintains backward compatibility while allowing admins to disable email exposure for privacy reasons. See: https://meta.discourse.org/t/security-privacy-concern-email-exposed-in-discourseconnect-provider-redirect-url/397980

Topic		Replies	Views
Setup DiscourseConnect - Official Single-Sign-On for Discourse (sso) Integrations sso , configuring , discourseconnect , how-to	45	455584	January 28, 2026
Use Discourse as an identity provider (SSO, DiscourseConnect) Integrations sso , discourseconnect , how-to	143	50518	November 9, 2024
DiscourseConnect / SSO. Force users to provide an email after redirecting from the parent website SSO discourseconnect , email	0	309	September 13, 2022
Create a DiscourseConnect login link Integrations sso , discourseconnect , how-to	6	6354	September 25, 2024
Integration into custom auth system where emails are not unique? SSO email	40	1456	June 6, 2024

Security/Privacy concern: Email exposed in DiscourseConnect Provider redirect URL

Related topics