Skip to content

Refactor Login with GitHub flow #2543

@setchy

Description

@setchy

Refactor the Login with GitHub OAuth flow to improve security and remove the need for client_secrets to be shared.

Options

  1. Add PKCE to our OAuth Web Flow - docs
  2. Migrate from OAuth App to GitHub App - docs
  3. Migrate from OAuth App with Web Flow to OAuth App with Device Code Flow - docs

I believe Option 3 is the only viable path since we are bundling and distributing a self-contained app without any secure server-side layer.

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or enhancement to existing functionalitypriority:highItems of high importance. Applicable to all users or use-cases

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions