Client secret shared between clients
Closed, ResolvedPublic3 Estimated Story Points
Actions

Assigned To

Authored By

	apaskulin
	Oct 2 2020, 5:45 PM

Description

Expected behavior

Clients created via the experimental create client endpoint do not share client secrets.
Resetting the client secret changes the value.

Observed behavior

At least four of clients I created via the endpoint have the same client secret.
Resetting the secret does not change the value.

Details

Related Changes in Gerrit:

	Subject	Repo	Branch	Lines +/-
	Making Client secret visible after a Client created.	mediawiki/extensions/OAuth	master	+5 -4
	Adding ":" to Client secret label (visible after a Client created) in Client creation popup.	mediawiki/extensions/WikimediaApiPortalOAuth	master	+1 -1

Customize query in gerrit

Related Objects
Search...

		Status	Subtype	Assigned	Task
		Resolved		Art.tsymbar	T264457 Client secret shared between clients
		Resolved		Art.tsymbar	T267755 OAuth extension - REST - show error (rights restrictions) messages instead of an object '{}'

Event Timeline

apaskulin created this task.Oct 2 2020, 5:45 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptOct 2 2020, 5:45 PM

apaskulin triaged this task as Medium priority.Oct 2 2020, 5:51 PM

apaskulin mentioned this in T261702: Acceptance testing for WikimediaApiPortalOAuth and updates to OAuth extension.

apaskulin raised the priority of this task from Medium to High.Oct 5 2020, 3:00 PM

apaskulin updated the task description. (Show Details)Oct 5 2020, 3:08 PM

apaskulin added a project: Platform Team Workboards (S&F Workboard).Oct 5 2020, 4:18 PM

apaskulin moved this task from Backlog to Current sprint Backlog on the Platform Team Workboards (S&F Workboard) board.

Helga_sf set the point value for this task to 3.Oct 6 2020, 10:18 AM

Art.tsymbar claimed this task.Oct 7 2020, 4:58 PM

Art.tsymbar moved this task from Current sprint Backlog to In Progress/Doing on the Platform Team Workboards (S&F Workboard) board.

Change 632974 had a related patch set uploaded (by Art.tsymbar; owner: arttsymbar):
[mediawiki/extensions/WikimediaApiPortalOAuth@master] Adding ":" to Client secret label (visible after a Client created) in Client creation popup.

https://gerrit.wikimedia.org/r/632974

gerritbot added a project: Patch-For-Review.Oct 8 2020, 6:26 PM

Change 632974 merged by jenkins-bot:
[mediawiki/extensions/WikimediaApiPortalOAuth@master] Adding ":" to Client secret label (visible after a Client created) in Client creation popup.

https://gerrit.wikimedia.org/r/632974

ReleaseTaggerBot added a project: MW-1.36-notes (1.36.0-wmf.13; 2020-10-12).Oct 8 2020, 8:00 PM

Maintenance_bot removed a project: Patch-For-Review.Oct 8 2020, 8:10 PM

Change 633551 had a related patch set uploaded (by Art.tsymbar; owner: arttsymbar):
[mediawiki/extensions/OAuth@master] Making Client secret visible.

https://gerrit.wikimedia.org/r/633551

gerritbot added a project: Patch-For-Review.Oct 12 2020, 2:22 PM

Art.tsymbar moved this task from In Progress/Doing to In Progress/In Review on the Platform Team Workboards (S&F Workboard) board.Oct 12 2020, 5:21 PM

Art.tsymbar mentioned this in T265362: OAuth extension - update\add logic of userCanSeeSecret() method of Backend\ConsumerAcceptance class..Oct 13 2020, 1:59 PM

Art.tsymbar added a subtask: T267755: OAuth extension - REST - show error (rights restrictions) messages instead of an object '{}'.Nov 11 2020, 6:44 PM

Change 633551 merged by jenkins-bot:
[mediawiki/extensions/OAuth@master] Making Client secret visible after a Client created.

https://gerrit.wikimedia.org/r/633551

Art.tsymbar moved this task from In Progress/In Review to PM Sign Off on the Platform Team Workboards (S&F Workboard) board.Nov 18 2020, 3:24 PM