Document new OAuth changes for 4.3.0
- [x] Add
/.well-known/oauth-authorization-serverdocumentation, per https://github.com/mastodon/mastodon/pull/29191 - [x] Document deprecation of
redirect_urionApplicationand addition ofredirect_uris - [x] Document added support for mutliple redirect URIs for OAuth Applications, per https://github.com/mastodon/mastodon/pull/29192
- [x] Add warning hints around
client_id,client_secret,access_tokenandcodevalues that they should be treated as if they are password, and stored securely. - [x] Document removal of required
readscope forGET /api/v1/apps/verify_credentials(this now just requires a valid access token), per https://github.com/mastodon/mastodon/pull/27142 - [x] Reworked OAuth Scopes page to be clearer.
- [x] Document
client_secret_expires_atonApplication, per https://github.com/mastodon/mastodon/pull/30317/ - [x] Document the fact that on 4.2.x Applications could be deleted at any time and result in broken authentication flows, fixed by https://github.com/mastodon/mastodon/pull/30316
- [x] Document
ApplicationvsCredentialApplicationsplit, per https://github.com/mastodon/mastodon/pull/29192 - [x] Document new
profilescope, per https://github.com/mastodon/mastodon/pull/30357 & https://github.com/mastodon/mastodon/pull/29087 - [ ] Document PKCE Extension, and why using PKCE is recommended for all applications, per: https://github.com/mastodon/mastodon/pull/31129
- [ ] Document Removal of OAuth Resource Owner Password Grant Flow, per: https://github.com/mastodon/mastodon/pull/30960
This branch is based on #1444
I have noticed that there is some churn here due to my editor using Prettier for markdown documents. We may want to consider adopting prettier for this repository.
This pull request has merge conflicts that must be resolved before it can be merged.
Have address majority of the code review comments and left replies where I disagree with said comments or need more information.
This pull request has resolved merge conflicts and is ready for review.
This pull request has merge conflicts that must be resolved before it can be merged.
This pull request has resolved merge conflicts and is ready for review.
Do we need anything here before merging it, as the 4.3 beta has been released?
Do we need anything here before merging it, as the 4.3 beta has been released?
@renchap I can follow up with a new PR for the last two items
@renchap have rebased this and finished the two remaining tasks.
I took the liberty to commit my two small adjustments, so that we can finally merge.
Feel free to open up a follow-up PR if you disagree with my changes. And thanks for all the hard work on this!
@oneiros those changes looked good, I think in the future reworking all this documentation to be more like AT Protocol's OAuth documentation might be a good idea. I think the current tutorial-based documentation leaves a lot to be desired.