Open Bug 1320689 Opened 9 years ago Updated 7 years ago

Support creating API keys with limited privileges

Categories

(bugzilla.mozilla.org :: API, enhancement)

Product:
bugzilla.mozilla.org
Component:
API
Version:
Production
Type:
enhancement
Priority:
Not set
Severity:
normal

Tracking

()

People

(Reporter: marco, Unassigned)

Details

(Whiteboard: [bugmaster-watchlist])

API keys inherit the same privileges as the user who created them. This means, for example, that there's no way to create an API key that doesn't have access to security bugs for a user that has privileges to see them. This behavior can also cause security problems. When you get more privileges on Bugzilla, you'd need to audit your pre-existing API keys.
Assignee: user-accounts → nobody
Component: User Accounts → API
Product: Bugzilla → bugzilla.mozilla.org
QA Contact: default-qa
Version: unspecified → Production
This would help resolve a concern that's been around with 3rd Party Web Apps that consume the API. Even if we just made it such that API keys do not have access to bugs in security groups, that'd be a useful change.

idea: if the api key was a jwt, you could encode permissions (scopes) into it. Aside from enlarging the storage type for this, what else would be required I wonder?

Type: defect → enhancement
You need to log in before you can comment on or make changes to this bug.