Skip to content

Commit 6771312

Browse files
committed
Revert "Prevent automatic OAuth grants for public clients (#30790) (#30836)"
This reverts commit 248a5b8. This commit introduces a regression descrdibed at go-gitea/gitea#30790 (comment) There is a commit to try and fix it, but it is similarly untested. Let's not accumulate regressions and wait until it is either field tested by humans in Gitea or a test is written. https://github.com/go-gitea/gitea/pull/31015/files
1 parent 07ad7dd commit 6771312

File tree

1 file changed

+2
-3
lines changed

1 file changed

+2
-3
lines changed

routers/web/auth/oauth.go

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -469,9 +469,8 @@ func AuthorizeOAuth(ctx *context.Context) {
469469
return
470470
}
471471

472-
// Redirect if user already granted access and the application is confidential.
473-
// I.e. always require authorization for public clients as recommended by RFC 6749 Section 10.2
474-
if app.ConfidentialClient && grant != nil {
472+
// Redirect if user already granted access
473+
if grant != nil {
475474
code, err := grant.GenerateNewAuthorizationCode(ctx, form.RedirectURI, form.CodeChallenge, form.CodeChallengeMethod)
476475
if err != nil {
477476
handleServerError(ctx, form.State, form.RedirectURI)

0 commit comments

Comments
 (0)