4 ms·
> That anyone can create an integration and ask for OICD scopes, is one thing, but why do they make it so easy to hand out their own scopes? That was probably
by 9wzYQbTYsAIc 4y ago
> That anyone can create an integration and ask for OICD scopes, is one thing, but why do they make it so easy to hand out their own scopes?
That was probably one of the advantages of shoe-horning authentication (OpenID) with the existing authorization standard (OAuth).
> Why is everyone linking this draft? It's got very little to do with what we're discussing.
> … Github ALSO uses OAuth2 to delegate permissions to the user's stuff on their own site
> … But even that should only have access to the user’s own repositories.
Seems like Rich Authorization Requests are exactly what we are discussing.
Give it a skim (or a read).
- vintermann 4y agoYou don't need RARs to limit access. It's just a proposal to standardize very fine-grained control access. This is not very fine-grained. It would be perfectly possible to gate access to social features of github (such as starring) behind a plain old scope. Distinguishing "access to all your own repositories" from "access to anything else on github, as you" also is not a fine-grained difference.
- 9wzYQbTYsAIc 4y agoSure, but the extra “location” and “action” objects within the proposed “authorization_details” JSON object do seem compelling when compared to just a single “scope” string.
- BlueTemplar 4y agoSpeaking of shoehorning things, it doesn't look particularly "Open" to me that website owners are free to pick a limited number of authenticating authorities, instead of letting the user to pick their own. (Imagine if e-mail adresses were considered "invalid" in forms if not from Gmail or Outlook !) It was especially bad with last years Advent of Code, where going through OpenID (or was it OAuth ?) was the ONLY way to join, and with only 3 options listed, none of which I wanted to use !