hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fix(oauth): require security scopes to list and revoke tokens

Browse source 
/api/oauth_tokens skipped the scope check, so a token with any scope
could list the user's sessions and revoke them.
This commit is contained in:
Lain Soykaf 2026-10-26 12:21:47 +04:00
commit c686b701dd
No known key found for this signature in database
4 changed files with 50 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

1
changelog.d/oauth-tokens-scopes.security Normal file
View file

@ -0,0 +1 @@
Require the read:security and write:security scopes to list and revoke OAuth tokens (HTTP Basic auth no longer works for these endpoints)