Scopes for application tokens #1964

New Issue

GiteaMirror · 2025-11-02T04:19:31-06:00

GiteaMirror commented

2025-11-02 04:19:31 -06:00

Originally created by @aunger on GitHub (Jun 22, 2018).

Allow authentication tokens to be limited in scope. Maybe something like GitHub:

https://developer.github.com/apps/building-oauth-apps/understanding-scopes-for-oauth-apps/

Originally created by @aunger on GitHub (Jun 22, 2018). Allow authentication tokens to be limited in scope. Maybe something like GitHub: https://developer.github.com/apps/building-oauth-apps/understanding-scopes-for-oauth-apps/ ![screenshot_2018-06-22-06-41-29](https://user-images.githubusercontent.com/2125216/41772789-0590a874-75e8-11e8-93b1-2f94e76d02fa.jpg)

GiteaMirror added the issue/confirmed type/feature labels 2025-11-02 04:19:31 -06:00

GiteaMirror closed this issue

2025-11-02 04:19:31 -06:00

GiteaMirror commented

2025-11-02 04:19:32 -06:00

@stale[bot] commented on GitHub (Jan 22, 2019):

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

@stale[bot] commented on GitHub (Jan 22, 2019): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

GiteaMirror commented

2025-11-02 04:19:32 -06:00

@randomchance commented on GitHub (Jan 9, 2020):

This would be pretty nice to have, especially for build authorizations.

@randomchance commented on GitHub (Jan 9, 2020): This would be pretty nice to have, especially for build authorizations.

GiteaMirror commented

2025-11-02 04:19:32 -06:00

@mpfaff commented on GitHub (May 3, 2020):

Are there any plans for this? I don't feel comfortable at all with giving every app full access to my Gitea account.

@mpfaff commented on GitHub (May 3, 2020): Are there any plans for this? I don't feel comfortable at all with giving every app full access to my Gitea account.

GiteaMirror commented

2025-11-02 04:19:33 -06:00

@mcansky commented on GitHub (May 7, 2020):

what can we do to help for this ?

@mcansky commented on GitHub (May 7, 2020): what can we do to help for this ?

GiteaMirror commented

2025-11-02 04:19:33 -06:00

@lunny commented on GitHub (May 7, 2020):

Send a PR. :)

@lunny commented on GitHub (May 7, 2020): Send a PR. :)

GiteaMirror commented

2025-11-02 04:19:33 -06:00

@Jean-Baptiste-Lasselle commented on GitHub (Nov 18, 2020):

Send a PR. :)

All scopes support in one PR? you made me sincerely laugh ^^ , nevertheless, it would really be awesome to have the concept of Oauth Apps onto gitea,making it it a real social platform

@Jean-Baptiste-Lasselle commented on GitHub (Nov 18, 2020): > Send a PR. :) All scopes support in one PR? you made me sincerely laugh ^^ , nevertheless, it would really be awesome to have the concept of Oauth Apps onto gitea,making it it a real social platform

GiteaMirror commented

2025-11-02 04:19:33 -06:00

@Coding-Kiwi commented on GitHub (Jan 4, 2021):

If I understand correctly, if I currently authorize an app it can use that oauth access_token to make a request to /users/{username}/tokens to generate an unlimited, non-expiring access token which then renders the whole oauth expiry/refresh logic useless.

EDIT: nope, the /users/{username}/tokens requires basic auth. Scopes would be awesome nontheless

@Coding-Kiwi commented on GitHub (Jan 4, 2021): If I understand correctly, if I currently authorize an app it can use that oauth access_token to make a request to `/users/{username}/tokens` to generate an unlimited, non-expiring access token which then renders the whole oauth expiry/refresh logic useless. EDIT: nope, the `/users/{username}/tokens` requires basic auth. Scopes would be awesome nontheless

GiteaMirror commented

2025-11-02 04:19:34 -06:00

@Morriz commented on GitHub (Apr 26, 2022):

bump...any updates? Or other pointers as to where the oidc jwt claims can be got via api? That way we can do our own management on users, teams and groups/role mappings.

@Morriz commented on GitHub (Apr 26, 2022): bump...any updates? Or other pointers as to where the oidc jwt claims can be got via api? That way we can do our own management on users, teams and groups/role mappings.

GiteaMirror commented

2025-11-02 04:19:34 -06:00

@cayolblake commented on GitHub (Oct 8, 2022):