From 37fc7b3dcd4c2c51010da77dd7b636da48da32ad Mon Sep 17 00:00:00 2001 From: "http://christian.amsuess.com/chrysn" Date: Fri, 28 Jan 2011 21:08:13 +0000 Subject: [PATCH] security issue with credentials page --- doc/todo/credentials_page.mdwn | 2 ++ 1 file changed, 2 insertions(+) diff --git a/doc/todo/credentials_page.mdwn b/doc/todo/credentials_page.mdwn index 161f63a80..6b90af144 100644 --- a/doc/todo/credentials_page.mdwn +++ b/doc/todo/credentials_page.mdwn @@ -29,3 +29,5 @@ such a page could have a form as described in [[todo/structured page data]] and >> and yes, you're right about the word misusage; thanks for pointing it out and fixing it. >> >> --[[chrysn]] + +an issue to be considered: for ways of authentication that don't explicitly mention the user name (and that would be everything but password; especially OpenID), there has to be a way to prevent users from hijacking an admin's account. the user wouldn't get more privileges, but the admin could find himself logged in as a user instead of an admin when he logs in using his OpenID, for example. he could fix it by removing the openid from the user's ("his") page, but it has to be taken care of nevertheless. --[[chrysn]] -- 2.45.0