oauth2 fixes

floatingghost commented

2022-08-21 14:10:35 +00:00

Owner

a lot of the oauth2 weirdness in pleroma was caused by it using the cookie-based session to pull out tokens - this meant that if you were to change frontends (and hence your token), your cookie would change as well, making the backend think you were a new user and skipping any checks for existing authorization

this change more or less removes session store for oauth2 (and honestly we should remove a lot more session stuff, oauth2 doesn't need state as well...)

a lot of the oauth2 weirdness in pleroma was caused by it using the cookie-based session to pull out tokens - this meant that if you were to change frontends (and hence your token), your cookie would change as well, making the backend think you were a new user and skipping any checks for existing authorization this change more or less removes session store for oauth2 (and honestly we should remove a lot more session stuff, oauth2 doesn't need state as well...)

👍 1

floatingghost added 2 commits 2022-08-21 14:10:36 +00:00