indieweb / indieauth

IndieAuth.net website code and IndieAuth Specification
52 stars 7 forks source link

Document URL update procedures #34

Open brandonkal opened 4 years ago

brandonkal commented 4 years ago

The Problem

  1. User logs in to example.com with username.blogplatform.com/profile as their ID.
  2. User repeats step 1 for several clients.
  3. User changes their ID to fullname.io
  4. This user is smart and sets a 301 redirect from username.blogplatform.com/profile to fullname.io
  5. User logs in to example.com as fullname.io
  6. User now sees they have created a new account, rather than keeping their existing account on example.com that they may expect. The user could log in using their old URL, but as far as the site is concerned, the user is only logging in as fullname.io

There is also the risk (though likely a small one for savvy early adopters) that a user loses control of their domain. Perhaps they let it expire and the DNS records now point elsewhere.