4 ms·

Probably a stupid question: Why can the user grant permission to third-party apps to star repos? What is the legitimate usage of this API?

• themoonisachees 4y ago
  I'm guessing to allow people to make github browser apps, like the official desktop app.
• greggman3 4y ago
  Their API lets you do almost anything you can do on github. Its whole point is to allow people to write apps that do all the things you'd on github. So, want to write a full front end for github? Do it. It's likely the github mobile app uses this API to provide every service it provides. Open issues, create repos, add comments, create gists, create releases, star repos, etc... https://docs.github.com/en/rest?apiVersion=2022-11-28 https://docs.github.com/en/rest?apiVersion=2022-11-28 All that said, I have ranted about github's permissions https://games.greggman.com/game/github-permission-problem/ https://games.greggman.com/game/github-permission-problem/
• raxxorraxor 4y ago
  It is a common problem for identity providers and their users that they do not have a strict definition of claims aside from a generic read/write. Otherwise the user would get a giant prompt upon first use about which claims are needed to proceed. If that takes hold, people will just click away the message and third party logon would be as vulnerable to phishing than conventional logins. Otherwise it is nice to have an API that almost can do anything. I think this is the strategy of GitHub, to provide a service beyond the user login and also serve as infrastructure.