Skip to content

Prevent admin Web IDE OAuth app misconfigurations

Issue: Prevent misconfigurations when admin updates th... (#433322 - closed)

What does this MR do and why?

In this MR, we introduce a callout that is rendered at the top of the edit Web IDE OAuth application admin page that serves to:

  1. Warn admins that changes to the configuration can affect the functionality of the Web IDE
  2. Educate them of conditions are required for the Web IDE
  3. Ability to restore configuration back to the default

Note that this applies to Web IDE OAuth application only.

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Dev QA:

Web IDE OAuth application:


  • Callout rendered for Web IDE OAuth application with appropriate copy.
  • On Restore to default button click, a confirmation modal is shown. Clicking the confirm button restores the application back to its original settings.
  • Confirm Web IDE works post restoration

Non Web IDE applications:

  • Does not show callout

Non Admin users:

  • Cannot reset the settings to default: returns 403 when attempting to make request to new endpoint

How to set up and validate locally


  • Ensure the web_ide_oauth flag is enabled.
  • If you haven't before, you will need to access the Web IDE (Open a project via Web IDE or click . on the project page). This action will create the OAuth Application.


  • Go to the admin application page > select Web IDE OAuth application (Name: GitLab Web IDE).
  • Click Edit
  • Should observe new alert.
Edited by Cindy Halim

Merge request reports