OAuth Application without Registering #5034

New Issue

GiteaMirror · 2025-11-02T06:12:02-06:00

GiteaMirror commented

2025-11-02 06:12:02 -06:00

Originally created by @vHanda on GitHub (Mar 9, 2020).

Hi. I'm the author of GitJournal (Website, GitHub), a note taking app which stores its notes in any git repo. Many of its users use Gitea to store their notes. It works perfectly. However, the setup process typically requires them to create the repo manually and add the ssh key provided as a deploy key on their own.

For users that want to do this faster and without having to jump to the browser, I integrate with popular git hosting APIs (GitHub and GitLab.org). So if they give access to GitJournal it will create the repo for them and add an ssh key as a deploy key.

This however isn't possible with Gitea as each instance requires an OAuth app to be registered before it can request access. Just like Github and Gitlab. I cannot just provide a random ClientID.

Do you think it would be possible to add some mechanism by which I could either -

Not provide a client ID and the Authorization Code Grant would still work? Perhaps the UI could be modified to clearly indicate this app is not registered with this instance?
Provide a way to dynamically register an application without having to authenticate with the server? Perhaps instead of an API, it could be a web-page where the parameters could be filled via URL parameters and if the user clicks on an "Agree" button it would go to a web-page with the client ID is in an easily copyable manner?

With (2), there shouldn't be any security risk.

In the case where an app that already exists with its exact parameters it would be nice to just return the existing client ID.

Originally created by @vHanda on GitHub (Mar 9, 2020). Hi. I'm the author of GitJournal ([Website](https://gitjournal.io), [GitHub](https://github.com/GitJournal/GitJournal)), a note taking app which stores its notes in any git repo. Many of its users use Gitea to store their notes. It works perfectly. However, the setup process typically requires them to create the repo manually and add the ssh key provided as a deploy key on their own. For users that want to do this faster and without having to jump to the browser, I integrate with popular git hosting APIs (GitHub and GitLab.org). So if they give access to GitJournal it will create the repo for them and add an ssh key as a deploy key. This however isn't possible with Gitea as each instance requires an OAuth app to be registered before it can request access. Just like Github and Gitlab. I cannot just provide a random ClientID. Do you think it would be possible to add some mechanism by which I could either - 1. Not provide a client ID and the Authorization Code Grant would still work? Perhaps the UI could be modified to clearly indicate this app is not registered with this instance? 2. Provide a way to dynamically register an application without having to authenticate with the server? Perhaps instead of an API, it could be a web-page where the parameters could be filled via URL parameters and if the user clicks on an "Agree" button it would go to a web-page with the client ID is in an easily copyable manner? With (2), there shouldn't be any security risk. In the case where an app that already exists with its exact parameters it would be nice to just return the existing client ID.

GiteaMirror added the type/proposal label 2025-11-02 06:12:02 -06:00

GiteaMirror commented

2025-11-02 06:12:03 -06:00

@techknowlogick commented on GitHub (Mar 9, 2020):

FWIW software such as Mastodon has an API endpoint that allows for a scenario such as (2) happening.

@techknowlogick commented on GitHub (Mar 9, 2020): FWIW software such as Mastodon has an API endpoint that allows for a scenario such as (2) happening.

GiteaMirror commented

2025-11-02 06:12:03 -06:00

@jonasfranz commented on GitHub (Dec 25, 2020):

OpenID Connect has a specification for client registration. Maybe that could be integrated.

@jonasfranz commented on GitHub (Dec 25, 2020): OpenID Connect has a specification for client registration. Maybe that could be integrated.

GiteaMirror referenced this issue

2025-11-02 14:23:59 -06:00

[PR #5034] [CLOSED] allow current user to reset their own password #17605

Sign in to join this conversation.