Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

OAuth2Application should have scope #25813

Open
hickford opened this issue Jul 10, 2023 · 4 comments
Open

OAuth2Application should have scope #25813

hickford opened this issue Jul 10, 2023 · 4 comments
Labels
proposal/accepted We have reviewed the proposal and agree that it should be implemented like that/at all. type/feature Completely new functionality. Can only be merged if feature freeze is not active. type/proposal The new feature has not been accepted yet but needs to be discussed first.

Comments

@hickford
Copy link
Contributor

hickford commented Jul 10, 2023 •
edited
Loading

Feature Description

OAuth2Application should record scope at registration.

OAuth2Grant scope should then be restricted to a subset of application scope.

This security improvement is especially valuable for public clients which are inherently vulnerable to client impersonation.

The consent screen should list the application scope https://imgur.com/a/7RRUPES

Screenshots

GitLab has this feature https://docs.gitlab.com/ee/integration/oauth_provider.html

GitHub does not
@hickford hickford added the type/proposal The new feature has not been accepted yet but needs to be discussed first. label Jul 10, 2023
@lunny lunny added type/feature Completely new functionality. Can only be merged if feature freeze is not active. proposal/accepted We have reviewed the proposal and agree that it should be implemented like that/at all. labels Jul 10, 2023
@hickford hickford mentioned this issue Jul 10, 2023
Closed
@hickford
Copy link
Contributor Author

Previous work that added scope to grants and access tokens @aunger #4300 and @jolheiser #20908

@harryzcy
Copy link
Contributor

Referencing #24767, where tokens are redesigned

@lunny
Copy link
Member

lunny commented Jul 14, 2023

Those are access_token, but this one is for application token

@strk
Copy link
Member

strk commented Jan 7, 2024

Are "scopes" what would let me only grant "read_email" to an application token ?
If so, this is what we'd need to be happier about allowing our users to login via Gitea to Discourse: https://discourse.osgeo.org/t/psc-vote-lets-move-this-list-to-discourse/6528/26

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
proposal/accepted We have reviewed the proposal and agree that it should be implemented like that/at all. type/feature Completely new functionality. Can only be merged if feature freeze is not active. type/proposal The new feature has not been accepted yet but needs to be discussed first.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@lunny @hickford @strk @harryzcy