Support for OAuth public clients (native apps)

[hickford]

The OAuth spec defines two types of client, confidential and public, however Gitea assumes all clients to be confidential.

OAuth defines two client types, based on their ability to authenticate securely with the authorization server (i.e., ability to maintain the confidentiality of their client credentials):

confidential Clients capable of maintaining the confidentiality of their credentials (e.g., client implemented on a secure server with restricted access to the client credentials), or capable of secure client authentication using other means.

public Clients incapable of maintaining the confidentiality of their credentials (e.g., clients executing on the device used by the resource owner, such as an installed native application or a web browser-based application), and incapable of secure client authentication via any other means.

The client type designation is based on the authorization server's definition of secure authentication and its acceptable exposure levels of client credentials. The authorization server SHOULD NOT make assumptions about the client type.

This is a barrier to native apps using OAuth https://datatracker.ietf.org/doc/html/rfc8252

Some OAuth server implementations that assume all clients are confidential web clients will need to add an understanding of public native app clients and the types of redirect URIs they use to support this best practice.

In particular, Gitea should record the client type https://datatracker.ietf.org/doc/html/rfc8252#section-8.4

Authorization servers MUST record the client type in the client registration details in order to identify and process requests accordingly.

and require PKCE for public clients: https://datatracker.ietf.org/doc/html/rfc8252#section-8.1

Authorization servers SHOULD reject authorization requests from native apps that don't use PKCE by returning an error message

[hickford]

First step would be to add client type field to type OAuth2Application https://github.com/go-gitea/gitea/blob/main/models/auth/oauth2.go and associated forms

GitLab has a confidential option:

Confidential Enable only for confidential applications exclusively used by a trusted backend server that can securely store the client secret. Do not enable for native-mobile, single-page, or other JavaScript applications because they cannot keep the client secret confidential.

[hickford]

Secondly I think handleAuthorizationCode would have to implement the logic described in https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3:

ensure that the authorization code was issued to the authenticated confidential client, or if the client is public, ensure that the code was issued to "client_id" in the request,

Right now when my native app tries to authenticate, it gets error "unauthorized_client: invalid client secret".

[hickford]

@jonasfranz who originally added OAuth support https://github.com/go-gitea/gitea/pull/5378 , do you have any insight?