Migration from OAuth1 to OAuth2 for OSM API #7333

strump · 2024-02-08T16:59:46Z

~~This PR doesn't make any UI changes.~~ If user was logged in to OSM account then he would see new alert asking to re-login. Old authentication secrets are removed. New OAuth2 token is requested.

Old OAuth1	New OAuth2
OM requires login + password to use it	OM still requires login + password, but could be changed to browser redirects
OM stores `string token` and `string secret` to authenticate each API call	OM stores only `string oauthToken` to authenticate API calls
Each API call requires additional query parameters: `oauth_consumer_key`, `oauth_token`, `oauth_signature_method` , `oauth_signature`, etc. See specfication	Each API call requires additional header `Authorization: Bearer {oauthToken}`

Questions

Q1. Users should re-login once after installing new OM version

Should we notifiy users somehow? Or they'll get notification why try to edit some POI.

A1: User would see alert asking to relogin.

Q2. What is time-to-live for OAuth2 token?

I couldn't find this info in OSM documentation. Installed OM on my Android to check when API call will fail.

Q3. Unused Facebook and Google authentications

Found some unsed code to login using Facebook or Google (probably with WebView). Should we keep it? Did it ever worked?

Q4. How to manage secrets properly?

I used my personal OSM account s.trump@gmail.com to register OAuth2 applications for prod and dev environments.

~~Someone should replace constants in private_default.h and editor/osm_auth.cpp with official ones and prepare secret values for prod env.~~ Already handled by @rtsisyk

Update 2024-03-10

If user was previously logged in then after installing new version he/she will see a dialog. This dialog informs him/her that old authentication is not working and he/she needs to re-login.

Update 2024-03-20

Note: text on the alert has "here" link. But it's not a link. It's just a text with blue color. When user taps on this UITextView a listener navigates to URL. To make part of text look blue I use two localizable strings instead of one:

Android	iOS
`{alert_reauth_message}`	`{alert_reauth_message_ios} + ' ' + {alert_reauth_link_text_ios}`
`Please login to OpenStreetMap to automatically upload all your map edits. Learn more <a href="https://github.com/organicmaps/organicmaps/issues/6144">here</a>.`	`Please login to OpenStreetMap to automatically upload all your map edits. Learn more` + space + `here`
Link is highlighted automatically. Pressing on a link works automatically too.	Need to add blue text style to `{alert_reauth_link_text_ios}` string manually. Handle tap event explicitly

strump · 2024-02-08T17:05:52Z

platform/http_client_apple.mm

+@interface RedirectDelegate : NSObject<NSURLSessionDataDelegate>
+
+@property(nonatomic) BOOL handleRedirects;
+
+- (instancetype)init:(BOOL)handleRedirects;
+
+- (void)        URLSession:(NSURLSession *)session
+                      task:(NSURLSessionTask *)task
+willPerformHTTPRedirection:(NSHTTPURLResponse *)response
+                newRequest:(NSURLRequest *)newRequest
+         completionHandler:(void (^)(NSURLRequest *))completionHandler;
+@end
+
+@implementation RedirectDelegate
+- (instancetype)init:(BOOL)handleRedirects
+{
+  self = [super init];
+  if (self)
+  {
+    _handleRedirects = handleRedirects;
+  }
+
+  return self;
+}
+
+- (void)        URLSession:(NSURLSession *)session
+                      task:(NSURLSessionTask *)task
+willPerformHTTPRedirection:(NSHTTPURLResponse *)response
+                newRequest:(NSURLRequest *)newRequest
+         completionHandler:(void (^)(NSURLRequest *))completionHandler
+{
+    if (_handleRedirects && response.statusCode >= 300 && response.statusCode < 400) {
+        completionHandler(nil);
+    }
+    else {
+        completionHandler(newRequest);
+    }
+}
+@end


Current implementation of bool HttpClient::RunHttpRequest() doesn't support handling of redirects.

Actual behaviour:

Make HTTP request to osm.org/oauth2/authorize

Server responses with HTTP Status 302 and redirects to om://oauth2/osm/callback?code=xQpf58...

iOS follows redirect and tries to open URL om://oauth2/osm/callback?code=xQpf58...

iOS gives error: Unknown protocol

Expected behaviour:

Make HTTP request to osm.org/oauth2/authorize

Server responses with HTTP Status 302 and redirects to om://oauth2/osm/callback?code=xQpf58...

If HttpClient::handle_redirects field is true then do not follow redirect and give back response from server.

To handle redirect I had to implement RedirectDelegate. Is it made correctly?

The current HttpClient/Downloader is one big mess, unfortunately. m_handleRedirects solution looks good to me.

Since when did increasing the entropy become a better solution? ;)

handleRedirects is unclear. Does it mean that HttpClient handles redirects automatically? Or the user should handle it manually? followRedirects is more clear.

Replaced handleRedirects with followRedirects all over the code.

strump · 2024-02-09T09:18:30Z

platform/http_session_manager.mm

-    dispatch_async(dispatch_get_main_queue(), ^{
+    dispatch_async(dispatch_get_current_queue(), ^{


For some reason tests on MacOS hangs with dispatch_get_main_queue() function. Replaced with dispatch_get_current_queue(). Looks like main queue != current queue. It doesn't break iOS.

But dispatch_get_current_queue() function is deprecated. What is propper fix here?

Because of my change tests are failing at assertion:

ASSERT_EQUAL(id, threads::GetCurrentThreadID(), ("OnWrite called from different threads"));

How to fix it on MacOS? Remove assert?

HTTP code is thread-safe only if it's called on the same thread. Instead of removing the assert, the callbacks logic should be checked, why different thread is used in different OnWrite calls.

Looks like there is no such thing as main thread in our test apps.
If you go to downloader_test.cpp you can see calls to QCoreApplication::exec().

I think, main queue is created only after QCoreApplication::exec() call. But it doesn't work for osm_auth_tests.cpp. I'm getting error:

QApplication::exec: Please instantiate the QApplication object first

This is how good stack trace looks like when running platform_tests:

dispatch_async(dispatch_get_main_queue(), ...) really dispatches call in main queue. Need to do simillar for osm_auth_tests.

@biodranik I found a workaround for MacOS: see commit #6c8171f8.

For MacOS each test should be wrapped in lambda and executed in a separate thread while main thread is used for main queue.

Do you have any ideas how to improve this solution? Introduce macro for this case?

That doesn't look like a good solution. A better approach is needed. Maybe hide relevant logic in the test's main, like it was already done for some tests, or check if the code can be corrected/rewritten properly.

@biodranik I changed HttpSessionManager behaviour in commit #ec7ece7e
Instead of using main queue for all callbacks it now uses custom queue.

Map download functionality works on iOS simulator. Tests oam_auth_tests does not fail.

Need to fix platform_tests

👆 Update: that solution doesn't actually work.

We can't replace main queue with custom queue because there is no guaranty that the same thread will be used. When we post task to a queue with dispatch_async(...) it could be handled from different threads. See https://stackoverflow.com/q/52389851

So we should either keep main queue and use some workarounds for unit-tests or get rid of queues and use threads in HttpSessionManager class.

rtsisyk · 2024-02-11T08:31:55Z

Q1. Users should login again after installing new OM version
Should we notifiy users somehow? Or they'll get notification why try to edit some POI.

My proposal is to keep the existing OAuth1 code for some time while we test this new OAuth2 implementation on Android first. Would it be possible to keep two versions?

Q2. What is time-to-live for OAuth2 token?
I couldn't find this info in OSM documentation. Installed OM on my Android to check when API call will fail.

Please use refresh tokens: https://oauth.net/2/refresh-tokens/

Q3. Unused Facebook and Google authentications

Found some unsed code to login using Facebook or Google (probably with WebView). Should we keep it? Did it ever worked?

Let's remove it via a separate PR.

Q4. How to manage secrets properly?

I used my personal OSM account s.trump@gmail.com to register OAuth2 applications for prod and dev environments.
Someone should replace constants in private_default.h and editor/osm_auth.cpp with official ones and prepare secret values for prod env.

Yes, please use private_default.h for now. I will take care of it later.

mmd-osm · 2024-02-11T15:55:03Z

Q2. What is time-to-live for OAuth2 token?
I couldn't find this info in OSM documentation. Installed OM on my Android to check when API call will fail.

Please use refresh tokens: https://oauth.net/2/refresh-tokens/

OAuth2 bearer tokens on osm.org don't expire at the moment, hence there's also no refresh token available. However, for the sake of being future proof, it's a good idea to consider refresh tokens. Maybe they will be opt-in at some point in the future.

--> https://github.com/openstreetmap/openstreetmap-website/blob/master/config/initializers/doorkeeper.rb#L213

biodranik · 2024-02-11T19:55:38Z

Q1. Users should re-login once after installing new OM version

Notification is definitely needed, maybe in the case of not uploaded edits only.

Q2. What is time-to-live for OAuth2 token?

It's not reset now, but it would be great to properly detect the case when it's reset, and at least offer to relogin again. Ideally use what Roman mentioned.

Q3. Unused Facebook and Google authentications

Don't remove it. We want to use it for faster user registration in OSM in the future, when we reuse OSM login instead of implementing OM auth.

Q4. How to manage secrets properly?

In the same way as they're managed now. We'll set them properly later.

rtsisyk · 2024-02-13T08:47:22Z

Q3. Unused Facebook and Google authentications

Don't remove it. We want to use it for faster user registration in OSM in the future, when we reuse OSM login instead of implementing OM auth.

What is the point of keeping died code? It will be broken during edits because it can't be run. The old code can always be restored from git when it is needed.

biodranik · 2024-02-13T20:49:16Z

Nobody will look for some older code in git history without knowing that some code existed before. Commented code is very explicit and acts as a TODO comment.

westnordost · 2024-02-15T16:36:03Z

Q2. What is time-to-live for OAuth2 token?

I couldn't find this info in OSM documentation. Installed OM on my Android to check when API call will fail.

Not only is there currently no refresh token because OAuth2 tokens on OSM are valid forever, according to the OSM website maintainers are of the opinion that expiring OAuth2 tokens would not really serve a useful purpose in the case of OSM because they can already be revoked by the user (source). So, it is very unlikely that OSM OAuth2 tokens will ever expire and that they will ever be refresh tokens.

That however does still mean that the case that the OAuth2 token suddenly is not accepted by OSM anymore needs to be handled gracefully. As before with OAuth 1.0a, I figure, because it is also possible for the user to revoke these tokens.

In StreetComplete, I blanket handle such cases by logging out the user (i.e. clearing the token) when any authorization-related HTTP error code is returned on any call to the OSM API (HTTP 401 or HTTP 403).

rtsisyk · 2024-02-18T12:20:40Z

I've heard today that OAuth1 in osm.org will be disabled on June 1 this year. I'm withdrawing my request for support for both versions. Please go ahead 🚀

rtsisyk · 2024-03-03T17:41:21Z

Is this patch ready for beta?

Jean-BaptisteC · 2024-03-03T18:05:52Z

I have done firsts tests on Android, and it works properly;
✅ Connection to OSM
✅ Update POI (I can't test to create a new POI, I use the developer OSM website)

strump · 2024-03-04T08:01:09Z

@rtsisyk feature is ready to merge. Tests are failing. Maybe PR #7405 will fix MacOS tests

I also made a change to osm_auth_tests. Asked @biodranik if my workaround is OK: comment

biodranik

Is there any UX migration for existing users? How do they know that they should login again?

What happens with Google Play users who were logged in but where OSM login dialog is disabled?

biodranik · 2024-02-09T22:54:05Z

editor/osm_auth.cpp

 namespace osm
 {
 using platform::HttpClient;
 using std::string;

 constexpr char const * kApiVersion = "/api/0.6";
-constexpr char const * kFacebookCallbackPart = "/auth/facebook_access_token/callback?access_token=";


Are these oauth2? Can we reuse them later for faster user registration, or should it be rewritten from scratch?

biodranik · 2024-02-16T11:25:36Z

platform/http_session_manager.mm

-    dispatch_async(dispatch_get_main_queue(), ^{
+    dispatch_async(dispatch_get_current_queue(), ^{


That doesn't look like a good solution. A better approach is needed. Maybe hide relevant logic in the test's main, like it was already done for some tests, or check if the code can be corrected/rewritten properly.

rtsisyk · 2024-03-10T09:00:50Z

tools/python/oauth2-flow/oauth2_flow.py

@@ -0,0 +1,226 @@
+import http.client


Thanks for adding this!!!

See #7333 Signed-off-by: Roman Tsisyk <roman@tsisyk.com>

rtsisyk

Thank you for this substantial contribution. I've tested it on both Android and iPhone, and it functions perfectly. Excellent job!

I agree with the comment that it would be nice to notify the user about the need for re-authentication. However, I don't see it as a blocker for this PR. The situation that the authentication token expires, and the user needs to authenticate is quite common. The app didn't handle such case before this PR and doesn't handle with this PR. Therefore, the existing state of affairs is preserved. My recommendation is to file a separate ticket for this issue and address it somewhere in the future, based on priorities.

rtsisyk · 2024-03-10T10:28:55Z

Credentials have been added to master.

biodranik · 2024-03-10T10:44:43Z

The situation that the authentication token expires, and the user needs to authenticate is quite common. The app didn't handle such case before this PR and doesn't handle with this PR.

It is not a common situation with OM and mapsme. The token has NEVER expired before. That is the reason why the app didn't handle such case.

It is crucially important to support a proper UX migration.

@strump did you test what happens in the following scenarios? Are there any notifications on iOS and Android?

Make sure you're logged in qith oauth1
Edit something on the current master but don't upload it to OpenStreetMap.org.
Update the app and run it with new oauth2
Any notifications about not uploaded features/missing login?
Edit something.
Any notifications?
Make sure that you're logged in with oauth1 and there are no edits.
Update the app
Any notifications?
Edit something
Any notifications?

biodranik · 2024-03-10T11:52:00Z

editor/osm_auth_tests/osm_auth_tests.cpp

  OsmOAuth auth = OsmOAuth::DevServerAuth();
  bool result;
  TEST_NO_THROW(result = auth.ResetPassword(kForgotPasswordEmail), ());
  TEST_EQUAL(result, true, ("Correct email"));
  TEST_NO_THROW(result = auth.ResetPassword("not@registered.email"), ());
-  TEST_EQUAL(result, false, ("Incorrect email"));
+  TEST_EQUAL(result, true, ("Server responses OK even if email is incorrect"));


This change should be reverted, it is wrong.

biodranik · 2024-03-10T11:54:42Z

editor/osm_auth_tests/server_api_test.cpp

@@ -20,6 +20,10 @@ using namespace pugi;
 extern char const * kValidOsmUser;
 extern char const * kValidOsmPassword;

+#if defined(OMIM_OS_MAC)
+extern void runMainQueue(void func());


This test workaround is very ugly, are there any better options?

biodranik · 2024-03-10T11:55:31Z

iphone/Maps/Classes/CustomViews/Login/MWMAuthorizationCommon.mm

@@ -11,6 +11,7 @@
 NSString * const kOSMRequestToken = @"OSMRequestToken";


Are all these constants still used?

biodranik · 2024-03-10T11:56:34Z

iphone/Maps/Classes/CustomViews/Login/MWMAuthorizationWebViewLoginViewController.mm

Aren't these controllers needed for Google/FB OSM auth?

biodranik · 2024-03-10T11:57:42Z

platform/http_client_apple.mm

+                newRequest:(NSURLRequest *)newRequest
+         completionHandler:(void (^)(NSURLRequest *))completionHandler
+{
+    if (_handleRedirects && response.statusCode >= 300 && response.statusCode < 400) {


Please check indents and code style (e.g. {}) everywhere. Maybe they are wrongly set in XCode.

biodranik · 2024-03-10T11:59:36Z

platform/http_client_apple.mm

+@interface RedirectDelegate : NSObject<NSURLSessionDataDelegate>
+
+@property(nonatomic) BOOL handleRedirects;
+
+- (instancetype)init:(BOOL)handleRedirects;
+
+- (void)        URLSession:(NSURLSession *)session
+                      task:(NSURLSessionTask *)task
+willPerformHTTPRedirection:(NSHTTPURLResponse *)response
+                newRequest:(NSURLRequest *)newRequest
+         completionHandler:(void (^)(NSURLRequest *))completionHandler;
+@end
+
+@implementation RedirectDelegate
+- (instancetype)init:(BOOL)handleRedirects
+{
+  self = [super init];
+  if (self)
+  {
+    _handleRedirects = handleRedirects;
+  }
+
+  return self;
+}
+
+- (void)        URLSession:(NSURLSession *)session
+                      task:(NSURLSessionTask *)task
+willPerformHTTPRedirection:(NSHTTPURLResponse *)response
+                newRequest:(NSURLRequest *)newRequest
+         completionHandler:(void (^)(NSURLRequest *))completionHandler
+{
+    if (_handleRedirects && response.statusCode >= 300 && response.statusCode < 400) {
+        completionHandler(nil);
+    }
+    else {
+        completionHandler(newRequest);
+    }
+}
+@end


handleRedirects is unclear. Does it mean that HttpClient handles redirects automatically? Or the user should handle it manually? followRedirects is more clear.

biodranik · 2024-03-10T12:03:21Z

qt/osm_auth_dialog.cpp

@@ -20,12 +20,12 @@ namespace qt
 char const * kTokenKeySetting = "OsmTokenKey";


Are these vars still used?

biodranik

Was maps downloading tested on the Simulator and the iOS device?

platform/http_client_apple.mm

biodranik · 2024-03-10T12:24:45Z

platform/http_client_apple.mm


  [[[HttpSessionManager sharedManager]
      dataTaskWithRequest:request
-                 delegate:nil


Can self implement the delegate in a simpler way?

Meaning: will it be simpler if instead of passing an external delegate, it will be implemented in this class, and delegate:self will be passed to the function?

biodranik · 2024-03-10T12:25:55Z

platform/http_client_apple.mm

-    m_urlReceived = response.URL.absoluteString.UTF8String;
+
+    NSString * redirectUri = [response.allHeaderFields objectForKey:@"Location"];
+    if (redirectUri)


The Location response header indicates the URL to redirect a page to. It only provides a meaning when served with a 3xx (redirection) or 201 (created) status response.

Should status code be checked too?

platform/http_client_curl.cpp

Signed-off-by: S. Kozyr <s.trump@gmail.com>

Made updates all over the code Signed-off-by: S. Kozyr <s.trump@gmail.com>

Signed-off-by: S. Kozyr <s.trump@gmail.com>

iphone/Maps/Classes/CustomAlert/MWMOsmReauthAlert.h

iphone/Maps/Classes/CustomAlert/MWMOsmReauthAlert.mm

iphone/Maps/Classes/CustomViews/Login/MWMAuthorizationCommon.mm

Removed EditorHostFragment.clearNoobAlertFlag() method Signed-off-by: S. Kozyr <s.trump@gmail.com>

… code Signed-off-by: S. Kozyr <s.trump@gmail.com>

Signed-off-by: S. Kozyr <s.trump@gmail.com>

rtsisyk · 2024-03-26T17:02:34Z

Please postpone merging of this PR until April's release is released. No need to rush. We will merge it in Apr (~1 week from now) to have more time for beta-testing.

kirylkaveryn

I have tested it on an iPhone11Pro (device) and it works well. Thank you!

…ev.openstreetmap.org Have to create new one and update Debug credentials Signed-off-by: S. Kozyr <s.trump@gmail.com>

rtsisyk · 2024-04-04T05:45:33Z

It's time to merge. Let's address all leftovers and pending comments via separate PRs.

biodranik · 2024-04-04T21:44:54Z

@strump what's left? Can you please create a separate issue for it, if necessary?

strump commented Feb 8, 2024

View reviewed changes

strump commented Feb 9, 2024

View reviewed changes

rtsisyk self-requested a review February 11, 2024 08:32

strump force-pushed the osm-oauth2-migration branch from 646f542 to 6c8171f Compare February 15, 2024 12:23

rtsisyk mentioned this pull request Feb 18, 2024

[docs] Removing dead code instead of commenting it out #7422

Open

strump marked this pull request as ready for review February 27, 2024 09:35

strump force-pushed the osm-oauth2-migration branch from b76b46c to a65811d Compare March 4, 2024 15:43

biodranik requested changes Mar 4, 2024

View reviewed changes

strump force-pushed the osm-oauth2-migration branch from 1747c27 to 454a95c Compare March 5, 2024 09:48

rtsisyk reviewed Mar 10, 2024

View reviewed changes

tools/python/oauth2-flow/oauth2_flow.py

@@ -0,0 +1,226 @@

import http.client

Copy link

Contributor

rtsisyk Mar 10, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for adding this!!!

rtsisyk added a commit that referenced this pull request Mar 10, 2024

[editor] Add OSM OAuth2 public credentials

f7f8143

See #7333 Signed-off-by: Roman Tsisyk <roman@tsisyk.com>

rtsisyk approved these changes Mar 10, 2024

View reviewed changes

rtsisyk requested a review from biodranik March 10, 2024 10:29

biodranik requested changes Mar 10, 2024

View reviewed changes

biodranik force-pushed the osm-oauth2-migration branch 3 times, most recently from 9a1a5be to 1469c03 Compare March 10, 2024 15:34

strump added 12 commits March 23, 2024 11:12

[strings] Regenerated strings

2639444

Signed-off-by: S. Kozyr <s.trump@gmail.com>

[ios] Added blue color for link inside MWMOsmReauthAlert

053c845

Signed-off-by: S. Kozyr <s.trump@gmail.com>

[strings] Regenerated strings

84c0586

Signed-off-by: S. Kozyr <s.trump@gmail.com>

[ios] Fixed OSM login alert UI

b2d3e0c

Signed-off-by: S. Kozyr <s.trump@gmail.com>

[ios] Added comments

c54bbce

Signed-off-by: S. Kozyr <s.trump@gmail.com>

[iOS] Moved new alert to viewDidLoad method

ff41bb5

Signed-off-by: S. Kozyr <s.trump@gmail.com>

Renamed HttpClient::m_handleRedirects to HttpClient::m_followRedirects

94b4720

Made updates all over the code Signed-off-by: S. Kozyr <s.trump@gmail.com>

[strings] Replaced 'alert_reauth_title' with 'login_osm'

714c7fb

Signed-off-by: S. Kozyr <s.trump@gmail.com>

[strings] Regenerated strings

61461a2

Signed-off-by: S. Kozyr <s.trump@gmail.com>

[ios] Removed debug method

d6797a3

Signed-off-by: S. Kozyr <s.trump@gmail.com>

[strings] Translated strings using tools/python/translate.py script

3b2608f

Signed-off-by: S. Kozyr <s.trump@gmail.com>

[strings] Regenerated strings

3ac8d63

Signed-off-by: S. Kozyr <s.trump@gmail.com>

strump force-pushed the osm-oauth2-migration branch from 14a1100 to 3ac8d63 Compare March 23, 2024 09:13

kirylkaveryn reviewed Mar 25, 2024

View reviewed changes

Formatting

37200ce

Removed EditorHostFragment.clearNoobAlertFlag() method Signed-off-by: S. Kozyr <s.trump@gmail.com>

strump force-pushed the osm-oauth2-migration branch from a532ff9 to 37200ce Compare March 25, 2024 09:14

strump added 4 commits March 25, 2024 11:25

[ios] Removed calls to NSUserDefaults.synchronize method all over the…

72296f6

… code Signed-off-by: S. Kozyr <s.trump@gmail.com>

[qt] Revert string initialization

f2413a5

Signed-off-by: S. Kozyr <s.trump@gmail.com>

[ios] Changed link handling with NSLinkAttributeName

3b77754

Signed-off-by: S. Kozyr <s.trump@gmail.com>

[ios] Removed 'retain' modificator

2f9adb1

Signed-off-by: S. Kozyr <s.trump@gmail.com>

kirylkaveryn approved these changes Mar 27, 2024

View reviewed changes

[oauth2] I accidentally removed OAuth2 application from master.apis.d…

eb2b34d

…ev.openstreetmap.org Have to create new one and update Debug credentials Signed-off-by: S. Kozyr <s.trump@gmail.com>

mmd-osm mentioned this pull request Apr 3, 2024

Deprecation of HTTP Basic Auth and OAuth 1.0a openstreetmap/operations#867

Open

rtsisyk merged commit 921cdaa into master Apr 4, 2024
16 checks passed

rtsisyk deleted the osm-oauth2-migration branch April 4, 2024 05:45

pastk mentioned this pull request Apr 11, 2024

Move OSM authentication to OAuth 2.0 #6144

Closed

mmd-osm mentioned this pull request Apr 12, 2024

OAuth 1.0a removal zerebubuth/openstreetmap-cgimap#354

Merged

		dispatch_async(dispatch_get_main_queue(), ^{
		dispatch_async(dispatch_get_current_queue(), ^{

		@@ -11,6 +11,7 @@
		NSString * const kOSMRequestToken = @"OSMRequestToken";

		@@ -20,12 +20,12 @@ namespace qt
		char const * kTokenKeySetting = "OsmTokenKey";

Migration from OAuth1 to OAuth2 for OSM API #7333

Migration from OAuth1 to OAuth2 for OSM API #7333

Conversation

strump commented Feb 8, 2024 • edited

Questions

Q1. Users should re-login once after installing new OM version

Q2. What is time-to-live for OAuth2 token?

Q3. Unused Facebook and Google authentications

Q4. How to manage secrets properly?

Update 2024-03-10

Update 2024-03-20

strump Feb 8, 2024 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

strump Feb 9, 2024 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

strump Feb 9, 2024 • edited

Choose a reason for hiding this comment

strump Feb 15, 2024 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

strump Feb 27, 2024 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rtsisyk commented Feb 11, 2024

mmd-osm commented Feb 11, 2024 • edited

biodranik commented Feb 11, 2024

rtsisyk commented Feb 13, 2024

biodranik commented Feb 13, 2024 • edited

westnordost commented Feb 15, 2024

rtsisyk commented Feb 18, 2024

rtsisyk commented Mar 3, 2024

Jean-BaptisteC commented Mar 3, 2024

strump commented Mar 4, 2024 • edited

biodranik left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rtsisyk left a comment

Choose a reason for hiding this comment

rtsisyk commented Mar 10, 2024

biodranik commented Mar 10, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

biodranik left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rtsisyk commented Mar 26, 2024 • edited

kirylkaveryn left a comment

Choose a reason for hiding this comment

rtsisyk commented Apr 4, 2024

biodranik commented Apr 4, 2024

strump commented Feb 8, 2024 •

edited

strump Feb 8, 2024 •

edited

strump Feb 9, 2024 •

edited

strump Feb 9, 2024 •

edited

strump Feb 15, 2024 •

edited

strump Feb 27, 2024 •

edited

mmd-osm commented Feb 11, 2024 •

edited

biodranik commented Feb 13, 2024 •

edited

strump commented Mar 4, 2024 •

edited

rtsisyk commented Mar 26, 2024 •

edited