> Why does Github automatically redirect back the 2nd time without asking the user to authorize again? Other comments here seem to disagree with this, but I th

> Why does Github automatically redirect back the 2nd time without asking the user to authorize again? Other comments here seem to disagree with this, but I think you are correct. In all of my applications with OAuth, I always ask the user to confirm, even if they already authorized. I figure that user should be very aware that they are authorizing a 3rd party. Now I've never actaully seen another system that worked this way (as was pointed out), but I think they are just doing that for user convenience without realizing the security implications.