bengler / checkpoint

Centralized identity store and authentication broker for web applications. It supports a number of authentication mechanisms and is provided via a http-interface.
MIT License
31 stars 2 forks source link

Action can be used to hijack accounts #12

Closed simen closed 12 years ago

simen commented 12 years ago

This action: post '/identities/:id/accounts/:provider/:uid' where users can side-load accounts associated with their own identity is potentialy unsafe and practically useless (except for gods that do mass-imports). I think this should be gods only.