Django-oauth-toolkit: Application Creation

[acenario]

Is there any reason why any registered user can create an application? I do not want users creating resource-owner based applications. I would like to limit application creation and parameters allowed. Only "developers" should be allowed to create applications and they should be granted specific scopes and only follow grant types that I allow.

What steps do you suggest I take?

[maryokhin]

+1. Was very surprised when I found out that anyone can use the application creation endpoint.

[acenario]

I manually add the urls and create a custom page for application creation. However, there should be a way to control this behavior within oAuth2_provider.

from oauth2_provider.views import base
#     url(r'^oAuth2/', include('oauth2_provider.urls', namespace='oauth2_provider')),
url(r'^oAuth2/authorize/$', base.AuthorizationView.as_view(), name="authorize"),
url(r'^oAuth2/token/$', base.TokenView.as_view(), name="token"),

[RodneyRichardson]

I discovered the application creation pages by luck, and changed to manually define the URLS in my own URL file (like @acenario).

I would suggest:
1) Remove the application creation URLs from oauth2_provider.urls
2) Add the application creation URLs to, say, oauth2_provider.app_urls, so people can use the current web pages if they want.

[smarlowucf]

+1 doesn't seem very secure to allow any user to create applications.

[dotmobo]

+1 It seems to be not secure. I added a TESTING (True/False) parameter in my settings file and i created a custom urls.py file like this :

from django.conf.urls import patterns, url
from oauth2_provider import views
from django.conf import settings

"""
Include oauth2_provider urls one by one because "/applications" urls are not secure.
See this issue :  https://github.com/evonove/django-oauth-toolkit/issues/196

"""

urlpatterns = patterns(
    '',
    url(r'^authorize/$', views.AuthorizationView.as_view(), name="authorize"),
    url(r'^token/$', views.TokenView.as_view(), name="token"),
    url(r'^revoke_token/$', views.RevokeTokenView.as_view(), name="revoke-token"),
)

# Warning : the following lines are unsecure
# Only added to validate oauth2_provider unit test
if settings.TESTING:
    # Application management views
    urlpatterns += patterns(
        '',
        url(r'^applications/$', views.ApplicationList.as_view(), name="list"),
        url(r'^applications/register/$', views.ApplicationRegistration.as_view(), name="register"),
        url(r'^applications/(?P<pk>\d+)/$', views.ApplicationDetail.as_view(), name="detail"),
        url(r'^applications/(?P<pk>\d+)/delete/$', views.ApplicationDelete.as_view(), name="delete"),
        url(r'^applications/(?P<pk>\d+)/update/$', views.ApplicationUpdate.as_view(), name="update"),
    )

Applications's routes are disable in production but enable when i launch unit tests

[nryoung]

:+1:, fine tuned permission controls would be a great addition.

[davidsidlinger]

This really needs to change. We will likely use the workaround of URL registration, but that seems unacceptably fragile in the long run. I'd even take a simple setting to disable the Applications UI.

[valerymelou]

I noticed this the first time I browsed the doc. I'm starting a new project using it and no way to continue without fixing it. But I think I will implement what @acenario said.

[poswald]

I agree with @RodneyRichardson's suggestion on this. A quick fix would be to simply remove the suggestion in the documentation to users that they should add all urls to their app via oauth2_provider.urls.

[poswald]

Can someone please check the documentation I added in #379 here? It's based roughly on @dotmobo's solution.

[francescobtl]

Hello, could someone please give me an example of how create a new application by code? It seems that tne tutorial only covers creation with o/applications. Thank you

[poswald]

@francescobtl You can create them just like any normal Django object. It would probably be better to ask that kind of question in the google group if you need more details rather than mix that with this discussion.

[poswald]

Unless someone objects, I'm going to merge #379 in. I checked it and updated it with a version that works and I think more follows urls.py best practices. I think it's important to get something into the docs ASAP as it's a security foot-gun for users otherwise.

[craigds]

I stumbled across this and wondered why those URLs are required at all? You can manage Application objects perfectly well in the admin interface. That would seem to be the 'normal' way to restrict access to these sorts of things.

[poswald]

Yeah I personally agree. I just merged it #379 in so it will go into the next release. I'll leave this issue open for now because I think there is still a debate to be had about the value of these views and how the application create/view/edit functionality should be exposed.

[jleclanche]

Since a change I landed a while back the app URLs are no longer required. You can pull in base_urlpatterns separately now.

[jhh3000]

+1

based on the way views.application is written, would it be easy to create an ApplicationOwnerIsStaffMixin where you further filter by is_staff=True? would be easy to add a settings variable to toggle this filter on and off too.

*edit: and will have to restrict permissions to ApplicationRegistration too

[n2ygk]

Closing due to age and no recent activity. Feel free to reopen/submit a PR if you are still interested.