-
-
Notifications
You must be signed in to change notification settings - Fork 4.8k
Simplify OAuth2 login flow #17165
Copy link
Copy link
Open
Labels
1. to developAccepted and waiting to be taken care ofAccepted and waiting to be taken care ofdesignDesign, UI, UX, etc.Design, UI, UX, etc.enhancementfeature: authentication
Metadata
Metadata
Assignees
Labels
1. to developAccepted and waiting to be taken care ofAccepted and waiting to be taken care ofdesignDesign, UI, UX, etc.Design, UI, UX, etc.enhancementfeature: authentication
Type
Fields
Give feedbackNo fields configured for Enhancement.
Projects
Status
🧭 Planning evaluation / ideas
Is your feature request related to a problem? Please describe.
When user trying to login using OAuth2 client, he sees three screens:
First is completely useless (#17136), third must be showed only one time.
Describe the solution you'd like
I suggest to create table to store scopes that user has granted to client and skip grant page if no new scopes were requested. Also user must be able to revoke access to some or all scopes through web ui.
Describe alternatives you've considered
Alternatively we can check scopes from previous sessions (column
scopeinauthtokentable).I would like to create PR, but firstly I want to discuss need I create new table or use
authtoken. Personally I prefer first variant because (1)authtokendoesn't have client id (only name) (2) even if user revokes all sessions it doesn't mean that user want to revoke access for client, so sessions and scopes must be stored separately (3) oauth sessions have small expiration period (1 hour, columnexpiresinauthtoken) and it is strange to check expired sessions.Additional context


