decaporg / decaporg/decap-cms

Use GitHub Apps instead of OAuth for the GitHub Backend

Open
#7,108 0 comments 16 reactions 0 assignees View on GitHub
area: extensions/backends/github type: feature
Dominant language
JavaScript
Stars
19.4k
Forks
3.1k
Avg merge
1d 14h
Merged PRs (30d)
9

Description

**Is your feature request related to a problem? Please describe.**

The current use of OAuth Apps in Decap poses a significant security risk by requiring access to all private repositories. This is a concern for many users, and a dealbreaker for some.

**Describe the solution you'd like**
I suggest transitioning Decap to use the newer GitHub Apps instead of OAuth Apps. GitHub Apps offer more granular repository access, providing much better security by allowing users to specify access permissions on a per-repository basis. This would fix https://github.com/decaporg/decap-cms/issues/4329.

**Describe alternatives you've considered**
Machine users have been proposed as an alternative, but that has many drawbacks.

**Additional context**
Transitioning to GitHub Apps aligns with best practices for security and would address the specific concerns outlined in issue https://github.com/decaporg/decap-cms/issues/4329. Users would benefit from improved control over repository access, contributing to a more secure and reliable experience.

See https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/differences-between-github-apps-and-oauth-apps

Contributor guide

Open the contributing guide

Research direction

Start by locating Decap's GitHub backend OAuth integration and review the concerns in issue 4329, along with GitHub's documented differences between OAuth Apps and GitHub Apps. Done means replacing the current OAuth flow with a GitHub App flow that supports repository-level access permissions.

Written by the indexing model from the issue text.

Assessment

Tech stack
github, javascript
Domain
authentication, backend, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.