No password confirmation for clients (and bearer?)

[rullzer]

We have the password confirmation on the web if you want to change certain things.

However, now that there is work on android to make (some) user info editable this becomes kind of annoying. We don't store the user password on android (we use the client login flow).

I think it would make sense to not enforce the login flow on client requests (or bearer auth for that matter).

Any opinions? @MorrisJobke @nickvergessen @schiessle @ChristophWurst ?

[ChristophWurst]

Makes sense, I guess.

[nickvergessen]

Well, as long as creating an app password is not possible without confirmation of the password, I'm fine with this.

[rullzer]

@nickvergessen good point. Same goes for the password change. Ok I'll look into that and report back

[ChristophWurst]

Ok I'll look into that and report back

🧐

[szaimen]

Related to nextcloud/android#1925