OAuth2Application should have scope #11196

New Issue

2025-11-02T09:30:29-06:00

GiteaMirror commented

2025-11-02 09:30:29 -06:00

Originally created by @hickford on GitHub (Jul 10, 2023).

Feature Description

OAuth2Application should record scope at registration.

OAuth2Grant scope should then be restricted to a subset of application scope.

This security improvement is especially valuable for public clients which are inherently vulnerable to client impersonation.

The consent screen should list the application scope https://imgur.com/a/7RRUPES

Screenshots

GitLab has this feature https://docs.gitlab.com/ee/integration/oauth_provider.html

GitHub does not

Originally created by @hickford on GitHub (Jul 10, 2023). ### Feature Description [OAuth2Application](https://pkg.go.dev/code.gitea.io/gitea@v1.19.4/models/auth#OAuth2Application) should record scope at registration. [OAuth2Grant](https://pkg.go.dev/code.gitea.io/gitea@v1.19.4/models/auth#OAuth2Grant) scope should then be restricted to a subset of application scope. This security improvement is especially valuable for public clients which are inherently vulnerable to client impersonation. The consent screen should list the application scope https://imgur.com/a/7RRUPES ### Screenshots GitLab has this feature https://docs.gitlab.com/ee/integration/oauth_provider.html GitHub does not

GiteaMirror added the type/proposal proposal/accepted type/feature labels 2025-11-02 09:30:29 -06:00

GiteaMirror commented

2025-11-02 09:30:30 -06:00

@hickford commented on GitHub (Jul 11, 2023):

Previous work that added scope to grants and access tokens @aunger https://github.com/go-gitea/gitea/issues/4300 and @jolheiser https://github.com/go-gitea/gitea/pull/20908

@hickford commented on GitHub (Jul 11, 2023): Previous work that added scope to grants and access tokens @aunger https://github.com/go-gitea/gitea/issues/4300 and @jolheiser https://github.com/go-gitea/gitea/pull/20908

GiteaMirror commented

2025-11-02 09:30:30 -06:00

@harryzcy commented on GitHub (Jul 12, 2023):

Referencing #24767, where tokens are redesigned

@harryzcy commented on GitHub (Jul 12, 2023): Referencing #24767, where tokens are redesigned

GiteaMirror commented

2025-11-02 09:30:30 -06:00

@lunny commented on GitHub (Jul 14, 2023):

Those are access_token, but this one is for application token

@lunny commented on GitHub (Jul 14, 2023): Those are access_token, but this one is for application token

GiteaMirror commented

2025-11-02 09:30:30 -06:00

@strk commented on GitHub (Jan 7, 2024):

Are "scopes" what would let me only grant "read_email" to an application token ?
If so, this is what we'd need to be happier about allowing our users to login via Gitea to Discourse: https://discourse.osgeo.org/t/psc-vote-lets-move-this-list-to-discourse/6528/26

@strk commented on GitHub (Jan 7, 2024): Are "scopes" what would let me only grant "read_email" to an application token ? If so, this is what we'd need to be happier about allowing our users to login via Gitea to Discourse: https://discourse.osgeo.org/t/psc-vote-lets-move-this-list-to-discourse/6528/26

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#11196