nextcloud / nextcloud/documentation
Oauth2 Security considerations, vague?
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 628
- Forks
- 2.5k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 135
Description
The security considerations for using oauth state the following:
This means that every token has full access to the complete account including read and write permission to the stored files.
and
Without scopes and restrictable access it is not recommended to use a Nextcloud instance as a user authentication service.
I understand that it's risky giving any service access to the tokens themselves.
But in case we use something like pusher/oauth2_proxy do these security considerations still apply? The underlaying app shouldn't get access to those tokens would it?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the OAuth2 security considerations quoted in the issue and review how oauth2_proxy handles tokens and scopes. Clarify whether the warnings apply when the underlying app does not receive the tokens, and update the relevant documentation so the distinction is explicit.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100