News for hackers. Stuff that matters.
Re:GitHub Community Forum by oneeyedpigeon on Tuesday November 14, 2017 @07:11AM (#15694361)
But they're different domains; how are they identifying me as a client?
Re:GitHub Community Forum by kroltan on Tuesday November 14, 2017 @07:16AM (#15694387)
github.community isn't. It sends you to github.com regardless, since their login is there. github.com sees you're already logged in, and redirects back, passing auth.
Re:GitHub Community Forum by chrismorgan on Tuesday November 14, 2017 @07:39AM (#15694497)
That suggests it’s bypassing OAuth—with OAuth you’d get a “GitHub Community wants access to X, Y and Z” interstitial.
Re:GitHub Community Forum by jon-wood on Tuesday November 14, 2017 @12:36PM (#15697240)
Most OAuth providers have a flag for first party clients which allows them to bypass the usual authorization dance and just bounce you straight back to the origin.
Re:GitHub Community Forum by Crespyl on Tuesday November 14, 2017 @11:11AM (#15696259)
Unless it's by the same authors as GitHub, and has access to the same OAuth client id/secrets as the master GitHub app.