element-hq / element-hq/element-web

switch to https:// redirect url for SSO login to improve "do you trust element://" UX

Open
#32,295 7 comments 0 reactions 0 assignees View on GitHub
A-Electron A-SSO S-Minor T-Enhancement
Dominant language
TypeScript
Stars
13.5k
Forks
2.8k
PR merge metrics
PR metrics pending

Description

After you complete SSO, the server will ask if you trust the client, before it hands access to your client to an unknown url:

![image](https://user-images.githubusercontent.com/1389908/113138428-ac752f80-921d-11eb-8e91-cfd99aa53b26.png)

If the redirect URI is `https`, Synapse will just display the hostname, rather than the full url.

It is therefore proposed that, at least for macOS and Windows, element-desktop register an intercept for a url under the `https://element.io` heirarchy and then use that as the redirect URI. That will make synapse show "Continuing will grant `element.io` access to your account" instead of an opaque (to the average user) `element://` URI.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.