search

OpenHumans / open-humans

Powering openhumans.org
https://www.openhumans.org/
MIT License
73 stars 22 forks source link

Allow projects to refresh OAuth2 client ID/secret #967

Open madprime opened 5 years ago

madprime commented 5 years ago

We should allow projects to refresh OAuth2 key/secret themselves.

Currently they request OH admins to do a refresh for them, which not great security (although a project could simply de-activate to prevent new authorizations).

madprime commented 5 years ago

probably using the generators from django-oauth-toolkit, e.g.

from oauth2_provider.generators import ClientIdGenerator, ClientSecretGenerator
cig = ClientIdGenerator()
csg = ClientSecretGenerator()
return (cig.hash(), csg.hash())