Allow empty scope authorization#3889
Conversation
Registries may allow using token authorization without explicitly setting the scope. This may cover use cases where no scope is required for an endpoint or the registry is only covering authentication using the token. This aligns with the oauth2 spec which specifies the scope as optional. Signed-off-by: Derek McGowan <[email protected]>
|
Build succeeded.
|
|
Any known registry service that had hit the issue? |
|
LGTM |
|
@AkihiroSuda see the conversation that back-referenced this. I don't think any registry is legitimately using this feature, however, we don't have a good reason to deviate from the oauth spec on this. This is more to help ensure that if a registry has a bug around setting the scope, the bug is manifesting itself during authorizing a token, rather than validating the |
Codecov Report
@@ Coverage Diff @@
## master #3889 +/- ##
==========================================
+ Coverage 42.32% 42.34% +0.02%
==========================================
Files 130 130
Lines 14678 14679 +1
==========================================
+ Hits 6212 6216 +4
+ Misses 7540 7538 -2
+ Partials 926 925 -1
Continue to review full report at Codecov.
|
Allow empty scope authorization
|
Will this be on a milestone before 1.4, like a patch release for 1.3.3? just wondering as I can only see a old milestone 1.3.1 and the next release 1.4 which doesn't contain this PR btw I'm asking as suggested here https://github.com/containerd/containerd/blob/master/RELEASES.md#next-release 🤓 |
Allow empty scope authorization
Allow empty scope authorization
Allow empty scope authorization
Allow empty scope authorization
Allow empty scope authorization
Allow empty scope authorization
7 participants
Registries may allow using token authorization without explicitly setting the scope. This may cover use cases where no scope is required for an endpoint or the registry is only covering authentication using the token. This aligns with the oauth2 spec which specifies the scope as optional.