Nitron/django-cas-provider — Issue #8: Prompting for authorization (security issue)
Author: AndreLouisCaron
Created: 2012-03-02 19:18:00+00:00
State: open

Currently, the only interaction `django-cas-provider` has with the user is to prompt for credentials. If a user accessed two services `A` and `B` and logs in to grant a service ticket for `A`, then `B` can silently get a service ticket. If this process is fast enough, the user may log in to application `B` without even realizing it.

This, the CAS provider should prompt for authorization for granting service tickets, especially after the single-sign-on session is already opened (e.g. the user is already logged in). This behavior could optionally be disabled by the user.