One thing I didn't like as a user, is that to a typical user on my university's installation, it was possible for any third party to invoke the auth flow in a h

One thing I didn't like as a user, is that to a typical user on my university's installation, it was possible for any third party to invoke the auth flow in a hidden iframe, meaning they could silently log user IDs if the user was signed in to CAS, and potentially have a sort of super-cookie to track people with or discover real-life identities. The user's recourse is to tick a checkbox on the login page to warn on each subsequent authentication. I made a userscript to always select that option and also add a shortcut key to quickly approve from the confirmation page (since it came up quite often when navigating through the myriad products that run the university.) I did think it was cool that they allowed third parties to use the system, but wish there were some easier way to prevent abuse. I don't have a lot of knowledge of other auth systems, but the CAS architecture did seem pretty simple -- maybe too simple for some usecases. I know my university sent extra user data (besides just the user ID) to HTTPS sites on *.university.edu, so potentially that could be used to deliver user info or tokens to retrieve more later.