6 ms·

Be careful: with Github auth, the redirection directs you to a non-HTTPS version of their app. The Github token might leak at that point... EDIT: I don't even

by xgbi 6y ago

Be careful: with Github auth, the redirection directs you to a non-HTTPS version of their app. The Github token might leak at that point... EDIT: I don't even know how it is possible, this is an Oauth2 Flow and should never redirect to a non HTTP URL from Github. Also: the fact that shuttleio doesn't have hsts or at least a 301 to HTTPS from HTTP is not brilliant either.

echelon 6y ago
This should be the top comment until remedied. This is super dangerous.
- xgbi 6y ago
  I created a report for Github, this is a leak on their side. And contacted ShuttleIO by mail. This could be ugly, Shuttle asks for broad permissions on Github.
  - gscho 6y ago
    Thank you for catching this. We are resolving this now
    - gscho 6y ago
      Just a quick update. We have disabled oAuth2 logins (Github, GitLab and BitBucket) temporarily while we update our configuration settings.
      - gscho 6y ago
        We've resolved the issue with all 3 providers, thank you!