Scoped Access for Oauth Tokens
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 36.9k
- Forks
- 5.2k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 713
Description
How to support this request?
- Please use the 👍 reaction to show that you are also in favor of this feature - we are using this information to decide which features to include in upcoming Nextcloud versions.
- Please don't comment if you have no relevant information to add
See the official documentation for reference. Filing in the hopes of Oauth tokens adding scoped access to address the security risk of only supporting full read+write access. Thanks for your consideration!
Nextcloud OAuth2 implementation currently does not support scoped access. This means that every token has full access to the complete account including read and write permission to the stored files. It is essential to store the OAuth2 tokens in a safe way!
Without scopes and restrictable access it is not recommended to use a Nextcloud instance as a user authentication service.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked OAuth2 administrator documentation and the current Nextcloud OAuth2 implementation. Determine how token permissions are represented and identify the affected tests or entry points; done means OAuth2 tokens can be restricted to defined read or write scopes without granting full account access.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100