Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(discord): prompt only if permissions have changed #469

Merged
merged 1 commit into from Oct 12, 2022
Merged

fix(discord): prompt only if permissions have changed #469

merged 1 commit into from Oct 12, 2022

Conversation

lrstanley
Copy link
Contributor

The current Discord oauth2 flow does not provide a prompt GET parameter during the redirect to Discord. As such, the default flow for Discord is to always prompt to validate the flow, even if the user has already previously approved the provided scopes. This PR ensures that prompt=none is provided, so Discord will only require a re-prompt if permissions have changed, or if there are elevated permissions being requested.

prompt controls how the authorization flow handles existing authorizations. If a user has previously authorized your application with the requested scopes and prompt is set to consent, it will request them to reapprove their authorization. If set to none, it will skip the authorization screen and redirect them back to your redirect URI without requesting their authorization. For passthrough scopes, like bot and webhook.incoming, authorization is always required.

I.e:

  • If scopes haven't been previously approved, prompt.
  • If sensitive scopes (bot & webhook.incoming) are used, ignore prompt parameter, and provide consent dialog.
  • If all scopes have already been approved previously, auto-redirect back to application.

Should be a non-breaking change.

- closes #401

Signed-off-by: Liam Stanley <me@liamstanley.io>
@techknowlogick techknowlogick merged commit dc95a43 into markbates:master Oct 12, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

discord oauth2 always forces authorization prompt (even if previously approved)
2 participants