Forum access states write access to private repositories required

Site Feedback
1

Hello,

When trying to log-in or sign up to the forum, I get the following prompt.

image
image582×322 25.6 KB

This notice of write access to private repositories and organisations raises concern as I’m not sure why participating in the forum should need these permissions.

However, the fairly minimal sounding oauth scope listed does not seem to match up with the notice itself, which makes me wonder if the notice is mistaken?

Would appreciate some clarification, very pleased with the site otherwise.

2

Good point!

In fact, the forum only asked for openid profile email.
But when an app requests no API scope, Forgejo issues an access token with full access to your account, and that’s what the warning described.
The forum never used that access. It only reads your name, email and avatar from the login.

This is now fixed:

  • The forum requests openid profile email public-only. The resulting token can’t read or change your account, repositories or organizations through the API or Git.
  • Existing forum logins were switched to the same restricted scope, so tokens issued before the change are limited as well.
  • The authorization page now shows the full-access warning only when an app really gets full access. For the forum you’ll just see the requested scopes.
3

Thanks for those changes, looks great!