Skip to content

Hash OAuth application secrets

Follow-up to #364110 (closed). We discovered some outside dependencies on the OAuth application secret being accessible after the fact. See discussion on the merge request starting at !91501 (comment 1031587853).

Possible dependency issues:

  • GitLab Pages
  • Grafana
  • Mattermost

We can consider whether it's easier to update the dependencies or if we can override some of the methods they use to work.

Availability & Testing

Please run the full package-and-qa job. For mattermost, we will be interested in the results of qa/specs/features/browser_ui/1_manage/login/log_into_mattermost_via_gitlab_spec.rb.

Edited by Sanad Liaquat