How do I disable auto-authentication for 3rd-party domains?

[MMeent]

Select Topic Area

Question

Body

I don't want to authorize or authenticate by default, even if it concerns a GitHub Pages website that's configured to "private". I think the current authentication redirect flow too quickly gives the owner access to authentication information about me (for start: that I'm logged in to GitHub with an account that has access to that repository).

How can I stop GitHub from auto-approving authentication requests- such as those for Pages on 3rd-party domains- when I'm logged into my GitHub account?

[yoannchaudet]

I think the current authentication redirect flow too quickly gives the owner access to authentication information about me

No information is shared with the owner of a Private Pages sites about who is accessing said sites. GitHub Pages does not have an analytics service for doing such things.

[MMeent]

For Pages hosted on external domains, the domain owner can change the resolver to switch over to their own servers, thus getting access to my cookies with auth tokens.

These cookies may contain no discernable identifying information themselves, but that's still at least two bits of information shared with the domain owner: the user has accessed the page before & was a logged-in GitHub user at that time.

[yoannchaudet]

That's not how DNS work fortunately!

[MMeent]

I don't think you understand.

I can set my DNS servers to whatever domain I want. If I currently host GH Pages, I can switch that to my own servers in minutes (assuming I use a low TTL for the A- or CNAME-record), after which all traffic to that website which was formerly directed to GH's servers is now directed to my own servers, which still includes the cookies set by GH for private pages' authentication.

Do you believe this not to be the case?

[yoannchaudet]

Ah gotcha. I did not understand what you meant earlier. The token in the cookie is short lived and only has permissions to read Pages content. It's also a secure cookie so you would have to redirect traffic to a server with a valid certificate to hope to capture anything. If you own the domain you already own the site. Our domain verification is aimed at preventing domain takeover attacks already.

Open a support ticket if you feel strong about that but that's something we captured in earlier security reviews for the product and deemed low risk.