#indieweb 2015-12-20

2015-12-20 UTC

aaronpk doing this opens up this security hole. we'd need to ensure that an indieauth client only allows the server to return a "me" url on the same domain. problem is there is no technical way of doing that.