No password confirmation for clients (and bearer?)
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 36.9k
- Forks
- 5.2k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 713
Description
We have the password confirmation on the web if you want to change certain things.
However, now that there is work on android to make (some) user info editable this becomes kind of annoying. We don't store the user password on android (we use the client login flow).
I think it would make sense to not enforce the login flow on client requests (or bearer auth for that matter).
Any opinions? @MorrisJobke @nickvergessen @schiessle @ChristophWurst ?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Review the existing password-confirmation behavior for web changes and the client login flow or bearer authentication paths mentioned in the issue. Clarify whether clients should bypass confirmation and which user-info changes are in scope. Done means the authentication policy is decided and the affected client behavior is implemented and covered by appropriate tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, php
- Domain
- api, authentication
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100