Application Creation

[acenario]

Is there any reason why any registered user can create an application? I do not want users creating resource-owner based applications. I would like to limit application creation and parameters allowed. Only "developers" should be allowed to create applications and they should be granted specific scopes and only follow grant types that I allow.

What steps do you suggest I take?

[maryokhin]

+1. Was very surprised when I found out that anyone can use the application creation endpoint.

[acenario]

I manually add the urls and create a custom page for application creation. However, there should be a way to control this behavior within oAuth2_provider.

from oauth2_provider.views import base
#     url(r'^oAuth2/', include('oauth2_provider.urls', namespace='oauth2_provider')),
url(r'^oAuth2/authorize/$', base.AuthorizationView.as_view(), name="authorize"),
url(r'^oAuth2/token/$', base.TokenView.as_view(), name="token"),

[RodneyRichardson]

I discovered the application creation pages by luck, and changed to manually define the URLS in my own URL file (like @acenario).

I would suggest:

1. Remove the application creation URLs from oauth2_provider.urls
2. Add the application creation URLs to, say, oauth2_provider.app_urls, so people can use the current web pages if they want.

[smarlowucf]

+1 doesn't seem very secure to allow any user to create applications.

[dotmobo]

+1 It seems to be not secure. I added a TESTING (True/False) parameter in my settings file and i created a custom urls.py file like this :

from django.conf.urls import patterns, url
from oauth2_provider import views
from django.conf import settings

"""
Include oauth2_provider urls one by one because "/applications" urls are not secure.
See this issue :  https://github.com/evonove/django-oauth-toolkit/issues/196

"""

urlpatterns = patterns(
    '',
    url(r'^authorize/$', views.AuthorizationView.as_view(), name="authorize"),
    url(r'^token/$', views.TokenView.as_view(), name="token"),
    url(r'^revoke_token/$', views.RevokeTokenView.as_view(), name="revoke-token"),
)

# Warning : the following lines are unsecure
# Only added to validate oauth2_provider unit test
if settings.TESTING:
    # Application management views
    urlpatterns += patterns(
        '',
        url(r'^applications/$', views.ApplicationList.as_view(), name="list"),
        url(r'^applications/register/$', views.ApplicationRegistration.as_view(), name="register"),
        url(r'^applications/(?P<pk>\d+)/$', views.ApplicationDetail.as_view(), name="detail"),
        url(r'^applications/(?P<pk>\d+)/delete/$', views.ApplicationDelete.as_view(), name="delete"),
        url(r'^applications/(?P<pk>\d+)/update/$', views.ApplicationUpdate.as_view(), name="update"),
    )

Applications's routes are disable in production but enable when i launch unit tests

[nryoung]

👍, fine tuned permission controls would be a great addition.

[davidsidlinger]

This really needs to change. We will likely use the workaround of URL registration, but that seems unacceptably fragile in the long run. I'd even take a simple setting to disable the Applications UI.

[valerymelou]

I noticed this the first time I browsed the doc. I'm starting a new project using it and no way to continue without fixing it. But I think I will implement what @acenario said.