[GH-ISSUE #1377] Too much permissions for GitHub Auth #449

New issue

Closed

opened 2026-03-16 15:23:08 +03:00 by kerem · 1 comment

kerem commented

2026-03-16 15:23:08 +03:00

Owner

Originally created by @yhnavein on GitHub (Dec 10, 2020).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/1377

Describe the bug
When you want to authenticate with GitHub there is definitely too much permissions being requested. Giving WRITE access to all of my repositories and gists (public and private) is a big no-no. It's potentially a security issue.

To Reproduce
Steps to reproduce the behavior:

From the browser: Go to https://hoppscotch.io
Click on Login with Github
OAuth screen from GitHub is presented with too much permissions requested

Expected behavior
Only permissions to see user's email is expected

Screenshots

Originally created by @yhnavein on GitHub (Dec 10, 2020). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/1377 **Describe the bug** When you want to authenticate with GitHub there is definitely too much permissions being requested. Giving WRITE access to all of my repositories and gists (public and private) is a big no-no. It's potentially a security issue. **To Reproduce** Steps to reproduce the behavior: 1. From the browser: Go to https://hoppscotch.io 2. Click on Login with Github 3. OAuth screen from GitHub is presented with too much permissions requested **Expected behavior** Only permissions to see user's email is expected **Screenshots** ![image](https://user-images.githubusercontent.com/516709/101758985-4f703500-3ad9-11eb-91b8-02d26620c7ac.png)

kerem closed this issue

2026-03-16 15:23:13 +03:00

kerem commented

2026-03-16 15:23:19 +03:00

Author

Owner

@liyasthomas commented on GitHub (Dec 10, 2020):

@yhnavein well, that's certainly not the case. Since #1367 and #1358, users can now:

Import Collections and Environments from a gist URL.
Create secret gist of Collections and Environments.
Create secret gist of API Documentation (Github Markdown flavored).

And these feature are only available for users who've signed in with GitHub. In near future we're also going to add syncing with repositories under team collaboration. So that explains why Hoppscotch GitHub OAuth app requires gist and repo permissions.

Since you raised this concern, I'll turn off repo permission for now since that feature is a WIP. But gist permission is mandatory to activate all the above mentioned features. You are always free to "Login with Google" to access Hoppscotch without gist sync feature. Thanks for reaching out. Will be turning off repo permissions for now.

@liyasthomas commented on GitHub (Dec 10, 2020): @yhnavein well, that's certainly not the case. Since #1367 and #1358, users can now: - Import Collections and Environments from a gist URL. - Create secret gist of Collections and Environments. - Create secret gist of API Documentation (Github Markdown flavored). And these feature are only available for users who've signed in with GitHub. In near future we're also going to add syncing with repositories under team collaboration. So that explains why Hoppscotch GitHub OAuth app requires gist and repo permissions. Since you raised this concern, <ins>I'll turn off repo permission for now since that feature is a WIP.</ins> But gist permission is mandatory to activate all the above mentioned features. You are always free to "Login with Google" to access Hoppscotch without gist sync feature. Thanks for reaching out. Will be turning off repo permissions for now.

kerem referenced this issue

2026-03-17 00:18:57 +03:00

[PR #449] [MERGED] ⬆️ Bump nuxt from 2.10.2 to 2.11.0 #2627