element-hq / element-hq/synapse
Include in SSO documentation that SSO redirect confirmation can be bypassed using the `sso.client_whitelist` option
Open
A-Config
A-Docs
A-Social Login
O-Uncommon
S-Tolerable
T-Task
Z-Help-Wanted
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
This issue has been migrated from [#11294](https://github.com/matrix-org/synapse/issues/11294).
---
It's [not currently obvious](https://github.com/matrix-org/synapse/issues/11290) that the SSO redirection page (introduced as a security measure) can be bypassed by use of the `sso.client_whitelist` option. This option allows specifying a whitelist of client URIs, for which the redirection page won't appear if the client you are being redirected to during SSO login.
We should include some words about it on the yet-to-be-written Single Sign-On documentation page.
Contributor guide
Assessment
This issue has not been assessed yet.