3 ms·

But they're different domains; how are they identifying me as a client?

• kroltan 9y ago
  github.community isn't. It sends you to github.com regardless, since their login is there. github.com sees you're already logged in, and redirects back, passing auth.
  • chrismorgan 9y ago
    That suggests it’s bypassing OAuth—with OAuth you’d get a “GitHub Community wants access to X, Y and Z” interstitial.
    • Crespyl 9y ago
      Unless it's by the same authors as GitHub, and has access to the same OAuth client id/secrets as the master GitHub app.
    • jon-wood 9y ago
      Most OAuth providers have a flag for first party clients which allows them to bypass the usual authorization dance and just bounce you straight back to the origin.