On Fri, May 25, 2018 at 11:24:08AM +1000, Alex Eng wrote:
> I don't think Fedora's OpenID login has this flaw. Would
it be possible
> to allow OpenID login for white-listed providers which are known to be
> well-behaved?
Unfortunately, Fedora's OpenID returns HTTP even when the request is with
HTTPS.
Does it? Let me check with the infrastructure team about getting that
fixed.
--
Matthew Miller
<mattdm(a)fedoraproject.org>
Fedora Project Leader