Currently, the extension requires the callback URL to use only the https scheme, and nothing else.
Since we'd like to start adopting OAuth in native apps, we would need the callback URL to be a deeplink into the app, which would be of the form wikipedia://oauth/callback, so the scheme restriction should be expanded to include it.
Description
Description
Details
Details
Related Changes in Gerrit:
| Subject | Author | Repo | Branch | Lines +/- | |
|---|---|---|---|---|---|
| Allow OAuth 2 callback URL to be custom app deeplink | Gergő Tisza | mediawiki/extensions/OAuth | master | +21 -4 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T395459 Epic: Use OAuth rather than password-based login for Wikimedia mobile apps (FY25-26) | |||
| Resolved | Dbrant | T386004 The `wikipedia:` URI scheme should be supported in MediaWiki | |||
| Resolved | matmarex | T410521 Add com.blogspot.wikikamus: to list of allowed OAuth2 URI schemes | |||
| Resolved | matmarex | T412542 Rethink protocol support for OAuth apps | |||
| Resolved | Tgr | T398441 Allow callback URL to be custom app deeplink |
Event Timeline
Comment Actions
Change #1166240 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):
[mediawiki/extensions/OAuth@master] Allow OAuth 2 callback URL to be custom app deeplink
Comment Actions
Spent some time testing this patch today, and I think it works as expected.
Test plan
Before
Tried to create (propose) an oauth2 consumer via Special:OAuthConsumerRegistration/propose/oauth2 with a deep link, which failed since the URL scheme doesn't match // or http:// or https://.
 |
After
I tried the same step mentioned above, but it failed when the consumer was marked as "confidential". Since deeplinks are considered non-confidential, they need to be explicitly stated in the form, and the code enforces these checks.
So I had to uncheck the "Client is confidential" field for this to work, and the consumer was created.
 |  |
Does the test plan sound reasonable @Tgr.
Comment Actions
Change #1166240 merged by jenkins-bot:
[mediawiki/extensions/OAuth@master] Allow OAuth 2 callback URL to be custom app deeplink