vider which is already supported by the current code. Azure
simply logged me in with a custom scope, without displaying the
requested scopes at all.
On Wed, Sep 10, 2025 at 5:03 PM Jacob Champion
wrote:
>
> On Wed, Sep 10, 2025 at 2:12 AM Zsolt Parragi
> wrote:
> > > I thi
t's also how I deal with it on the validation side, I just
wasn't sure if adding provider specific hacks to the client is a good
idea, if we can make it generic that works with anything.
On Mon, Sep 8, 2025 at 7:08 PM Jacob Champion
wrote:
>
> On Sun, Sep 7, 2025 at 12:03 PM Zsolt P
e more restricted google APIs, and verify if the user
is allowed to connect or not
So this is not strictly OAuth now, but still within what can be
implemented in a validator library.
On Tue, Sep 9, 2025 at 4:13 PM Jacob Champion
wrote:
>
> On Tue, Sep 9, 2025 at 1:16 AM Zsolt Parragi
>
e, moving part of
the logic to the server side? And that would solve these scenarios we
are talking about, there would be no question who and how created the
access token. Naive PKCE support only on the client side, and still
only sending an access token to the server wouldn't help the security
think about adding an `oauth_authentication_method`
parameter to the frontend, which defaults to `basic`, but can be
changed to `post` (or `http_basic` and `request_body`, as the rfc
refers to them)?
On Mon, Sep 8, 2025 at 11:58 AM Daniel Gustafsson wrote:
>
> > On 8 Sep 2025, at 11:46,
t the redirect URL
for the web login flow. If somebody tries to use a postgres client id
with their own redirect endpoint, that won't work.
On Wed, Sep 10, 2025 at 10:47 PM Jacob Champion
wrote:
>
> On Wed, Sep 10, 2025 at 11:50 AM Zsolt Parragi
> wrote:
> > > and the onl
> 428 for? Do they use 401 for invalid_client?
During the wait for the user to enter the device code. It's documented here:
https://developers.google.com/identity/protocols/oauth2/limited-input-device#authorization-pending
On Mon, Sep 8, 2025 at 10:11 AM Daniel Gustafsson wrote:
>
> >
In the previous email I attached a git diff not a proper patch file, I
added the correct attachment to this email.
On Sun, Sep 7, 2025 at 8:02 PM Zsolt Parragi wrote:
>
> Hello Hackers,
>
> While working on an OAuth validator for PG18 I noticed that currently
> the client code do
Hello Hackers,
While working on an OAuth validator for PG18 I noticed that currently
the client code doesn't work when using Google as the OAuth provider.
It requires two small changes:
* The device code request only includes the OAuth Client ID in the
request body if the user doesn't specify a
Andrew Dunstan wrote:
>
>
> On 2025-02-08 Sa 4:39 AM, Zsolt Parragi wrote:
> > Hello,
> >
> > We ran into an issue where pgindent stopped reformatting anything with
> > our custom exclude file, and after some investigation we found the
> > empty line acci
Hello,
We ran into an issue where pgindent stopped reformatting anything with
our custom exclude file, and after some investigation we found the
empty line accidentally inserted into the exclude file.
Pgindent currently treats empty lines as valid exclusions and creates
an empty regex from them.
11 matches
Mail list logo
