Bug 20627 - Prevent leakages of user permissions to api access tokens
Summary: Prevent leakages of user permissions to api access tokens
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: master
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Martin Renvoize
QA Contact: Testopia
Depends on: 20568 20612
  Show dependency treegraph
Reported: 2018-04-20 12:48 UTC by Martin Renvoize
Modified: 2020-02-01 08:21 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Note You need to log in before you can comment on or make changes to this bug.
Description Martin Renvoize 2018-04-20 12:48:23 UTC
Bug #20568 allow users to create API access tokens, but it always associates all a users permissions with that access token and additionally if that user comes to have more permissions down the line those additional permissions are automagically added to the access token as well. This is generally bad practice for access tokens as in general, they should be of a definite scope and any time additional privileges are required the client application should have to ask for them and receive a new token with the additional privileges assigned to it.
Comment 1 Marcel de Rooy 2020-01-31 09:55:19 UTC
Any developments on this front since almost two years passed? :)
Comment 2 Martin Renvoize 2020-02-01 08:21:18 UTC
I still hope to get to it at some point.. likely when rebasing Kyle's work on permissions which is on my list for later this month.

I envisage an OAuth2 style scopes system from the API perspective.. but th foundations for that are not yet available in Koha permissions code.