Start with a design review and review of OAuth code. May want a full security review if we're storing private data, even though this will run in labs.
Description
Description
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Declined | None | T132934 Security review of TWL | |||
| Resolved | • dpatrick | T132929 Review TWL OAuth implementation |
Event Timeline
Comment Actions
@Sadads I'm a bit behind and working on completing this review. Is there a demo site available for testing?
Comment Actions
that would be @ThatAndromeda for support -- you will have to reach out to her. @Nikkimaria and @Ocaasi can help: I am currently traveling for Wikimania & other conferences.
Comment Actions
Github: https://github.com/thatandromeda/twlight
Demo site: https://secret-lowlands-75266.herokuapp.com/oauth/login (There's nothing at / right now, but /oauth/login will show you the logging in part, and create an account for you with the lowest level of privileges.)
These codebases are probably somewhat out of sync at this point, but the authorization parts are the same. Lots of parts are obviously not done, but again, the auth part is stable. The key file there is https://github.com/thatandromeda/TWLight/blob/master/TWLight/users/authorization.py .