Skip to content

Conversation

@michielbdejong
Copy link
Collaborator

@michielbdejong michielbdejong commented Dec 4, 2024

Better information to the end user, about what the application is getting access to.

@michielbdejong michielbdejong marked this pull request as draft December 4, 2024 13:19
@michielbdejong michielbdejong force-pushed the fix-consent-information branch from 189ca44 to 14a0b55 Compare December 10, 2024 11:22
@michielbdejong
Copy link
Collaborator Author

Rebased and implemented more cleanly, now that I understand config overrides. I inserted the word 'full' in the phrase 'An application is requesting full access' and the word 'all' in 'Do you trust this application to read and write all your data on your behalf?'. Leaving them out would be downplaying the impact of 'accept', and would make the consent unusable:
Screenshot 2024-12-10 at 12 22 42

@michielbdejong michielbdejong marked this pull request as ready for review December 10, 2024 11:25
@michielbdejong
Copy link
Collaborator Author

No need to merge this before the migration. Would prefer to get some more reviews and merge in January 2025.

@michielbdejong
Copy link
Collaborator Author

After investigating solid/web-access-control-spec#34 (comment) and realising that acl:origin in WAC is not an implementation of client identification, it's clear to me we do need to adopt this security improvement now; merging.

@michielbdejong michielbdejong merged commit 66aab65 into main Jan 16, 2025
@michielbdejong michielbdejong deleted the fix-consent-information branch January 16, 2025 11:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants