gnh1201/mastodon
1
0
Fork 0
mirror of https://github.com/mastodon/mastodon.git synced 2025-07-15 08:48:15 +00:00
Code Issues Actions 15 Packages Projects Releases Wiki Activity

Only enable resource owner password grant flow if ldap or pam is enabled

Browse Source 
Resource Owner Password Grant flow is considered insecure and should not generally be used. It seems that both PAM and LDAP seem to require it, which is unfortunate, but this at least improves the security of servers that aren't using those.
This commit is contained in:
Emelia Smith 2023-09-16 18:30:13 +02:00
parent bd06c13204
commit bf8d132557
No known key found for this signature in database
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
config/initializers/doorkeeper.rb
View File

@ -164,7 +164,11 @@ Doorkeeper.configure do
# http://tools.ietf.org/html/rfc6819#section-4.4.3
#
grant_flows %w(authorization_code password client_credentials)
if Devise.ldap_authentication || Devise.pam_authentication
grant_flows %w(authorization_code client_credentials password)
else
grant_flows %w(authorization_code client_credentials)
end
# Under some circumstances you might want to have applications auto-approved,
# so that the user skips the authorization step.