Skip to content

Commit b0d8089

Browse files
jaxoncreedjaxoncreed
committed
Page styling
1 parent 91c7a3a commit b0d8089

File tree

2 files changed

+72
-25
lines changed

2 files changed

+72
-25
lines changed

‎common/disclaimer.html‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
<html>
2+
<head>
3+
<title>Solid Consent Disclaimer</title>
4+
</head>
5+
<body>
6+
<h1 id="grantingaccesstoanapplicationaspartofauthentication">Granting access to an application as part of authentication</h1>
7+
8+
<p><strong>TL:DR: This is a temporary option that will be removed once we have better ways of granting access to applications. We recommend you grant read and write access by default, but it depends on the application you want to trust.</strong></p>
9+
10+
<p>Applications provide very useful ways of consuming and producing data. Solid provides functionality that allows you to grant access to applications that you trust. This trust might be misplaced sometimes though, which Solid tries to mitigate to lessen the harm that malicious applications can cause.</p>
11+
12+
<p>One of the strategies available in Solid is to check the origins of applications, and in solid-server in Node version 5 (NSS5) we set the configuration for this to be true by default. This strengthens the security of instances running on this codebase, but it also makes it more difficult for users to test applications without explicitly granting them access beforehand.</p>
13+
14+
<p>To facilitate a better user experience, we introduced the option of granting access to applications as part of the authentication process. We believe this is a <a href="https://github.com/solid/node-solid-server/issues/1142">better flow then forcing users to navigate to their profile and use the functionality provided in the trusted applications pane</a>, and offer this as a temporary solution.</p>
15+
16+
<h2 id="whichmodesshouldigranttheapplication">Which modes should I grant the application?</h2>
17+
18+
<p>That really depends on what the application needs to do. In general we suggest granting it Read and Write access. </p>
19+
20+
<p>This is what the various modes allows the application to do:</p>
21+
22+
<ul>
23+
<li><strong>Read:</strong> Allows the application to read resources - this includes navigating through your pod and potentially copy all of your data</li>
24+
25+
<li><strong>Write:</strong> Allows the application to change and delete resources</li>
26+
27+
<li><strong>Append:</strong> Allows the application to only append new content to resources, not remove existing content</li>
28+
29+
<li><strong>Control:</strong> Allows the application to set which access modes agents have (including themself) - by allowing this you essentially allow the application complete control of your pod</li>
30+
</ul>
31+
32+
<p>The last mode is a very powerful mode to grant an application. An application could use this to remove all of your control access, essentially locking you out of your pod. (This would also mean that the application couldn't get access to your pod though, as it is still relying on your authentication.)</p>
33+
34+
<h2 id="whyisittemporary">Why is it temporary?</h2>
35+
36+
<p>The way this solutions works "behind the scenes" is that you are granting the application access to all resources that you have access to and that is connected to your profile (in general this would be the pod that was created alongside your WebID). This is probably fine when you want to test an application that you or someone you trust are developing, but it's definitely not the granular access control we want to offer.</p>
37+
38+
<p>We do not have a solution ready yet, but <a href="https://github.com/solid/webid-oidc-spec">we are working on it</a>. When the solution is specified and implemented in NSS, we will remove the option in the login flow, as you would go through another process of granting applications access that would result in a more granular control.</p>
39+
40+
<h2 id="learnmore">Learn more</h2>
41+
42+
<p>The way that we handle access control in Solid is described in <a href="[http://solid.github.io/web-access-control-spec/](http://solid.github.io/web-access-control-spec/)">the Web Access Control specification (WAC)</a>. If you want to understand the reasoning for why we chose to turn origin checking on by default, you can read about it in the <a href="https://www.w3.org/community/solid/wiki/Meetings#20190307_1400CET">Meeting W3 Solid Community Group had March 7th 2019 (last point on the agenda)</a>.</p>
43+
</body>
44+
</html>

‎default-views/auth/consent.hbs‎

Lines changed: 28 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -10,36 +10,39 @@
1010
</head>
1111
<body>
1212
<div class="container title">
13-
<div class="page-title">
14-
<h1>Authorize this app to use your data?</h1>
15-
<p>You will be authorizing <strong>{{app_origin}}</strong> to have access perform the actions indicated below.</p>
16-
<p>NOTE: This screen is TEMPORARY. Eventually more fine-tuned controls will be available.</p>
17-
<p>For more information see the <a href="https://github.com/solid/node-solid-server/blob/master/docs/login-and-grant-access-to-application.md" target="_blank">full explanation</a>.</p>
18-
</div>
19-
20-
<form method="post" action="/consent">
13+
<h1>Authorize this app to use your data?</h1>
14+
<div class="panel panel-default">
15+
<div class="panel-body">
16+
<div class="page-title">
17+
<p>You will be authorizing <strong>{{app_origin}}</strong> to have access to perform the actions indicated below.</p>
18+
<p>NOTE: This screen is TEMPORARY. Eventually more fine-tuned controls will be available.</p>
19+
<p>For more information see the <a href="/common/disclaimer.html" target="_blank">full explanation</a>.</p>
20+
</div>
21+
<form method="post" action="/consent">
2122

22-
<input id="read" type="checkbox" name="access_mode" value="Read" checked>
23-
<label for="read">Read your data</label>
24-
<br>
23+
<input id="read" type="checkbox" name="access_mode" value="Read" checked>
24+
<label for="read">Read your data</label>
25+
<br>
2526

26-
<input id="write" type="checkbox" name="access_mode" value="Write" checked>
27-
<label for="write">Write new data</label>
28-
<br>
27+
<input id="write" type="checkbox" name="access_mode" value="Write" checked>
28+
<label for="write">Write new data</label>
29+
<br>
2930

30-
<input id="append" type="checkbox" name="access_mode" value="Append" checked>
31-
<label for="append">Add to existing data</label>
32-
<br>
31+
<input id="append" type="checkbox" name="access_mode" value="Append" checked>
32+
<label for="append">Add to existing data</label>
33+
<br>
3334

34-
<input id="control" type="checkbox" name="access_mode" value="Control">
35-
<label for="control">Control who can access your data</label>
36-
<br>
37-
<br>
35+
<input id="control" type="checkbox" name="access_mode" value="Control">
36+
<label for="control">Control who can access your data</label>
37+
<br>
38+
<br>
3839

39-
<button type="submit" class="btn btn-primary" name="consent" value="true">Authorize</button>
40-
<button type="submit" class="btn btn-default" name="cancel" value="true">Cancel</button>
41-
{{> auth/auth-hidden-fields}}
42-
</form>
40+
<button type="submit" class="btn btn-primary" name="consent" value="true">Authorize</button>
41+
<button type="submit" class="btn btn-default" name="cancel" value="true">Cancel</button>
42+
{{> auth/auth-hidden-fields}}
43+
</form>
44+
</div>
45+
</div>
4346
</div>
4447
</body>
4548
</html>

0 commit comments

Comments
 (0)