Development record
The brief session page cannot itself tell a GitHub App's client id from an OAuth app's, so a relay the repository names or the person confirmed could report app_type github-app while holding an OAuth app; with no scope requested a fresh grant reaches public data only, but a person who earlier granted that OAuth app wider scopes is signed in again silently with them
issueopenminoriss-2610150102542349
The brief session page cannot itself tell a GitHub App's client id from an OAuth app's, so a relay the repository names or the person confirmed could report app_type github-app while holding an OAuth app; with no scope requested a fresh grant reaches public data only, but a person who earlier granted that OAuth app wider scopes is signed in again silently with them
Frontmatter
| id | iss-2610150102542349 |
|---|---|
| type | issue |
| lifecycle | open |
| severity | minor |
.abcd/work/issues/open/iss-2610150102542349-the-brief-session-page-cannot-itself.md
open on GitHub ↗ · commit history ↗