Repository navigation
Oauth2 Security considerations, vague? #1858
Description
Activity
Still present.
admin_manual/configuration_server/oauth2.rstlines 41-43 warn that tokens have full account access and that using Nextcloud as an auth service is not recommended, but the note doesn't distinguish between two very different use cases:- An app receives the OAuth2 token and uses it to call Nextcloud APIs (full access warning fully applies).
- A proxy like
oauth2_proxyuses Nextcloud only for the authentication step; the underlying application never sees or uses the token (the full-access warning doesn't apply in the same way).
Adding a clarification that the warning applies to case 1, and that using Nextcloud purely as an identity provider (without the app receiving the token) is a different and less risky setup, would make this note more accurate and actionable.
The security considerations for using oauth state the following:
and
I understand that it's risky giving any service access to the tokens themselves.
But in case we use something like pusher/oauth2_proxy do these security considerations still apply? The underlaying app shouldn't get access to those tokens would it?