Add new Django setting to restrict allauth endpoints that are exposed #1670
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Currently, we use allauth's regular "account" provider for user management in dev, and its github "socialaccount" provider for prod. However, we expose endpoints for both auth flows in prod and dev. This commit adds a new setting `ENABLE_GITHUB_OAUTH`. If enabled, only the github socialaccount provider endpoints are exposed. If disabled, only the "account" provider endpoints are exposed.
This app only needs to be installed if github oauth is enabled.
jjnesbitt
approved these changes
Jul 31, 2023
There was a problem hiding this comment.
Nice work! Tested this locally and can confirm I don't see any github oauth URLs, while manually changing the setting shows only the github oauth login flow.
I haven't tested the full Github login flow with this change, but to my knowledge it should remain unchanged.
|
Related #1644 |
danlamanna
approved these changes
Jul 31, 2023
mvandenburgh
added
patch
|
🚀 PR was released in |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Currently, we use allauth's regular "account" provider for user management in dev, and its github "socialaccount" provider for prod. However, we expose endpoints for both of these auth flows in prod and dev. This means that someone can sign up using the regular "account" provider in production, bypassing github entirely. In practice, this hasn't happened before because we don't advertise these URLs publicy; however if you know the URL, a user could navigate to https://api.dandiarchive.org/accounts/signup/ directly and sign up.
This PR adds a new setting
ENABLE_GITHUB_OAUTH. If enabled, only the github socialaccount provider endpoints are exposed. If disabled, only the "account" provider endpoints are exposed.