Files
discourse/lib
David Taylor 6b6b31a97f FEATURE: Allow admins to opt-in to seamless redirects on /auth/* (#31235)
By default, when multiple login providers are enabled, Discourse
requires user interaction before triggering an external auth flow. This
is defense-in-depth against "Login CSRF" attacks.

This commit introduces a setting to control this behavior, so that it
can be disabled when admins fully trust the downstream systems, and need
an interaction-free login flow on a site with multiple login providers.

Default behavior remains unchanged.
2025-02-07 11:43:39 +00:00
..
2022-04-28 11:51:03 +02:00
2024-08-12 10:41:13 +02:00
2024-11-06 06:27:49 +08:00
2023-02-21 10:30:48 +01:00
2025-02-04 13:49:16 -03:00