bullet-train-co / bullet_train

The Open Source Ruby on Rails SaaS Template
MIT License
1.67k stars 267 forks source link

Remove a couple of the riskier Doorkeeper grant flows #1772

Closed jagthedrummer closed 1 day ago

jagthedrummer commented 2 days ago

The password and implicit grant flows are a little riskier from a security standpoint. We're removing them so that we ship a more secure default. It's easy enough for a developer add them to the Doorkeeper config if they're needed.

If you need to bring back one or both of these you can add them back to config/initializers/doorkeeper.rb here:

https://github.com/bullet-train-co/bullet_train/pull/1772/files#diff-c7fc4e057f18c41db72e3ab775f9871e6bee4d7e2b0aba1fdbfb2ea209dd2141L371-R371

Fixes https://github.com/bullet-train-co/bullet_train/issues/820