fablabbcn / fablabs.io

The platform of the global Fab Labs Network
https://fablabs.io
GNU Affero General Public License v3.0
67 stars 33 forks source link

Do not skip asking users for authorization to OAuth apps #593

Closed MacTwister closed 2 years ago

MacTwister commented 2 years ago

Typically, in OAuth grant flows, the user needs to confirm the requesting app can access your profile (the first time). I think this is a nice privacy check, to make sure this is the user's intention. It's happened to me, that I accidentally click login, all of a sudden, I have an account.

This will also add an extra "click" step, for all the fake account bots. I'm uncertain if this will have an impact, but it will be an extra step towards signups in (i.e., Forums, GitLab, etc).

I am not aware of any possible impacts, apart from new first time logins to apps.

See doorkeeper docs on Skip Authorization

doorkeeper authorization window