4 ms·

Am I missing something? While there does not seem to be a reason to allow CSRF here, doesn't the fact that you need to have a client Id and client secret for t

Am I missing something? While there does not seem to be a reason to allow CSRF here, doesn't the fact that you need to have a client Id and client secret for the oath endpoint make it so that this is a non-issue? https://github.com/doorkeeper-gem/doorkeeper/wiki/authorization-flow https://github.com/doorkeeper-gem/doorkeeper/wiki/authorizat... I don't see a way to get the access token without having the client ID and client secret.

homakov 12y ago
you just need to create a client. Then you will have ID+secret. Most providers allow anyone to get them
- Stefan-H 12y ago
  So this only applies to those that use doorkeeper to act as oauth providers, not to those that allow logins through other oauth providers, right?
  - homakov 12y ago
    Sure, Doorkeeper is oauth Provider gem, not client.