3 ms·
Gitea serves as an OIDC provider: * https://docs.gitea.com/next/development/oauth2-provider https://docs.gitea.com/next/development/oauth2-provider However, I
by arcastroe 3y ago
Gitea serves as an OIDC provider:
* https://docs.gitea.com/next/development/oauth2-provider https://docs.gitea.com/next/development/oauth2-provider
However, I don't see an equivalent API in gitea to the "debug_token" api.
If I'm developing an application that allows "Login with Gitea", how do I make sure my application is not vulnerable?
- vladvasiliu 3y agoSee caseysoftware's reply: https://news.ycombinator.com/item?id=38022536 https://news.ycombinator.com/item?id=38022536 The access token usually has an `aud` field that says for whom it is. I'm not familiar with Gitea's implementation, but reading your link, it would seem that it acts as an oauth2 provider so that 3rd parties can access Gitea, not some other random app. > Gitea supports acting as an OAuth2 provider to allow third party applications to access its resources with the user's consent.