I need to outsource authentication to an IdP (Identity Provider) but I don't want that IdP to know of the calling site. The two major issues are the callback URL and the
Is there any way to "hide" or mask the callback URL,
referer header and any other data that may exist?
Some ideas might include
- Using an object such as ActiveX, or add-in
- Adapting Mozilla Persona to the idea (unless it already does it)
- Callback to a proxy that simply hops and anonymizes the traffic
Is anyone aware of a way to authenticate a site using a 3rd party, hide the source site's identity?