4 ms·

GitHub provides a way for more granular third-party access: GitHub Apps. There, access can be set on a repository level [1]. E.g. Netlify can be configured as a

GitHub provides a way for more granular third-party access: GitHub Apps. There, access can be set on a repository level [1]. E.g. Netlify can be configured as a GitHub app. It seems like Docker Hub is implemented as an OAuth app [2], where these granular options are not available and you have to grant access to all your repositories. [1] https://developer.github.com/apps/differences-between-apps/ https://developer.github.com/apps/differences-between-apps/ [2] https://docs.docker.com/docker-hub/builds/link-source/ https://docs.docker.com/docker-hub/builds/link-source/

andy_ppp 7y ago
You can implement OAuth per repo if github wanted though, or alternatively can you grant access to a specific organisation? Not sure. The default should be per repo auth IMO.
mmmeff 7y ago
Holy shit this is a crazy attack vector.
matthewaveryusa 7y ago
I just looked at github OAuth scopes ( https://developer.github.com/apps/building-oauth-apps/understanding-scopes-for-oauth-apps/ https://developer.github.com/apps/building-oauth-apps/unders... ) honest question, what's the point of using OAuth when the Authz is so coarse? Why not augment to have scopes per repo? Is it considered bad practice to have have a variable (repo name) as a scope?
- nickgros 7y ago
  IIRC the OAuth2-interfacing application needs to (or at least should) know beforehand exactly what to request access to, so if that's read/write access to all of the user's content, it's trivial. For the external application to know something specific like a particular resource is more complicated to deal with (especially with private/hidden content), so most OAuth providers don't provide that level of granularity. It can be done, it just requires more engineering than most (all?) off-the-shelf OAuth solutions provide, and it's more control than most users actually need.

andy_ppp 7y ago

You can implement OAuth per repo if github wanted though, or alternatively can you grant access to a specific organisation? Not sure. The default should be per repo auth IMO.

mmmeff 7y ago

Holy shit this is a crazy attack vector.

matthewaveryusa 7y ago

I just looked at github OAuth scopes ( https://developer.github.com/apps/building-oauth-apps/understanding-scopes-for-oauth-apps/ https://developer.github.com/apps/building-oauth-apps/unders... ) honest question, what's the point of using OAuth when the Authz is so coarse? Why not augment to have scopes per repo? Is it considered bad practice to have have a variable (repo name) as a scope?

nickgros 7y ago
IIRC the OAuth2-interfacing application needs to (or at least should) know beforehand exactly what to request access to, so if that's read/write access to all of the user's content, it's trivial. For the external application to know something specific like a particular resource is more complicated to deal with (especially with private/hidden content), so most OAuth providers don't provide that level of granularity. It can be done, it just requires more engineering than most (all?) off-the-shelf OAuth solutions provide, and it's more control than most users actually need.