Django-oauth-toolkit: Security Issue using Client ID and Secrets

[lokilak]

I am very new to this Oauth still reading through the documentation, I am seeing a strange behavior, so wanted to ask this question to get some clarity.
Followed the documentation and did a initial basic setup everything is working fine , able create application, get keys.
But one thing is bothering me. I have created USER A and USER B using admin panel and then created applications for each of them with Authorization and resource owner flows.
so test works fine and able to access the protected resources, but to test something took Client ID and Secret of USER B and authenticated using User A Credentials(username &password) and got authorization code and access token and able to access the protected API resources, now i am confused if this expected behavior. My thought is that USER A should get denied access when he tried to use USERB's Client and Secret to get the token.

[MattBlack85]

@lokilak it seems the Application should be aware of the user that is using it, sounds like a problem to me but I may miss some other aspects, could you please provide a test case for this scenario? that would be very useful

[MattBlack85]

@lokilak I think I am wrong here and what you describe is fine, the app is related to the user but it doesn't mean other users cannot that to authenticate themselves against some resources, can't remember exactly now but aren't those just a sign of the creator of the app? I think the app user is the only one that can edit it.

[FluidSense]

Oauth tokens are not meant to replace a users' username and password, but let users give other apps access to their protected data.

An example would be if I were to create an application which shows GitHub stats. Then I would create an oauth-application which would be connected to my user. However, that connection is only identification for Github, in case I use it for something malicious and they want to ban me 🤷 My app would then use the generated credentials to identify the app, so that when users log in to Github _through my app_, my app gets access to their data as specified by the scopes. The app could then use the access token to get data from Github and display stats for the user who logged in.

[MattBlack85]

thanks for the confirmation @FluidSense , closing this :)