4 ms·
I've always had at least one confirmation page where it stated what data would be shared with the 3rd party and what kind of access they get to my account.
by iforgotpassword 4y ago
I've always had at least one confirmation page where it stated what data would be shared with the 3rd party and what kind of access they get to my account.
- yashap 4y agoTrue, there’s often a “GitHub will have access to your email address” type confirmation in SSO flows, as that’s basically what SSO is (it’s GH telling a 3rd party “yup this is bob@example.com, feel free to log them into your site as bob@example.com”). However, what you won’t see in a standard SSO flow is anything along the lines of “GitHub will be able to star repositories on your behalf.” If you’re seeing those kind of messages, you aren’t doing a minimal SSO flow (just having GH vouch for your identity), you’re granting access to a 3rd party to do things with your GH account.