Page MenuHomePhabricator

Hide "client is confidential" checkbox for OAuth 2 owner-only clients
Closed, ResolvedPublic

Description

When the "This consumer is for use only by..." checkbox is checked, a bunch of form fields get hidden as irrelevant for owner-only consumers, but the confidential checkbox doesn't. But it isn't really conceptually meaningful (what does it mean for a client tied to a single user to be public? it's usually defined as being able to keep the client secret secret; but while owner-only clients do receive a client secret, they are banned from all the endpoints where they could actually make use aof it), and it has no practical application (the only impact of the checkbox is forcing PKCE when using the authorization code flow, but owner-only clients cannot use the authorization code flow).

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Change #1309847 had a related patch set uploaded (by SD0001; author: SD0001):

[mediawiki/extensions/OAuth@master] Hide "client is confidential" checkbox for owner-only clients

https://gerrit.wikimedia.org/r/1309847

Change #1309848 had a related patch set uploaded (by SD0001; author: SD0001):

[mediawiki/extensions/OAuth@master] Hide grant types radio input for owner-only clients

https://gerrit.wikimedia.org/r/1309848

Change #1309847 merged by jenkins-bot:

[mediawiki/extensions/OAuth@master] Hide "client is confidential" checkbox for owner-only clients

https://gerrit.wikimedia.org/r/1309847

matmarex assigned this task to SD0001.
matmarex subscribed.

Change #1309848 had a related patch set uploaded (by SD0001; author: SD0001):

[mediawiki/extensions/OAuth@master] Hide grant types radio input for owner-only clients

https://gerrit.wikimedia.org/r/1309848

This was merged as well, @gerritbot must have had a hiccup. Thanks for the patches!