jazzband / django-oauth-toolkit

OAuth2 goodies for the Djangonauts!
https://django-oauth-toolkit.readthedocs.io
Other
3.11k stars 790 forks source link

Documentation is still missing w.r.t. hashed secrets #1238

Open n2ygk opened 1 year ago

n2ygk commented 1 year ago

Describe the bug

In DOT 2.x the client_secret is now stored hashed. Documentation (including warning text in the HTML template) was added for the admin UI but was missed for the documentation and non-admin UI endpoints as documented in getting_started

To Reproduce

  1. Run a DOT-using app
  2. Go to http://127.0.0.1:8000/o/applications/register/
  3. Note that there's no clear warning about copying the client_secret before save as there is in the admin UI.

Expected behavior

The user should be warned to copy the secret before save as is done at http://127.0.0.1:8000/admin/oauth2_provider/application/add/

Version

2.2.0

Additional context

See #1235 although that issue says the unhashed secret was used so the error may be unrelated.

JordiNeil commented 1 year ago

I've been spending couple hours debugging this as I expected it not to be so hard to solve 😵‍💫 And I found that in this ApplicationRegistration view we're not passing the help_texts parameter to the modelform_factory method, then I added it like this just for testing image But stills not getting the help text in the response, this time I lost the track at the rendering moment, seems like django.forms.widgets does not handle help_texts 🤔