2021-05-10 UTC
# 
tomlarkworthy its not an attack. I can create not-tom.example.com and have an authorization_endpoint that auto logins in for anybody, then we are in the same position, real tom is logged into the app as not-tom.example.com after being tricked