hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fix(oauth): require security scopes to list and revoke tokens

Browse source 
/api/oauth_tokens skipped the scope check, so a token with any scope
could list the user's sessions and revoke them.
This commit is contained in:
Lain Soykaf 2026-10-26 12:21:47 +04:00
commit c686b701dd
No known key found for this signature in database
4 changed files with 50 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/development/API/pleroma_api.md
View file

@ -780,6 +780,7 @@ Emoji reactions work a lot like favourites do. They make it possible to react to
### Retrieve a list of active sessions for the user
* Method: `GET`
* Authentication: required
* OAuth scope: `read:security`
* Params: none
* Response: JSON
* Example response:
@ -808,8 +809,9 @@ Emoji reactions work a lot like favourites do. They make it possible to react to
### Revoke a user session by its ID
* Method: `DELETE`
* Authentication: required
* OAuth scope: `write:security`
* Params: none
* Response: HTTP 200 on success, 500 on error
* Response: HTTP 201 on success, 500 on error
## `/api/v1/pleroma/settings/:app`
### Gets settings for some application