mirror of
https://github.com/rclone/rclone.git
synced 2024-11-22 16:07:57 +08:00
dc7e3ea1e3
Before this change, rclone supported authorizing for remote systems by going to a URL and cutting and pasting a token from Google. This is known as the OAuth out-of-band (oob) flow. This, while very convenient for users, has been shown to be insecure and has been deprecated by Google. https://developers.googleblog.com/2022/02/making-oauth-flows-safer.html#disallowed-oob > OAuth out-of-band (OOB) is a legacy flow developed to support native > clients which do not have a redirect URI like web apps to accept the > credentials after a user approves an OAuth consent request. The OOB > flow poses a remote phishing risk and clients must migrate to an > alternative method to protect against this vulnerability. New > clients will be unable to use this flow starting on Feb 28, 2022. This change disables that flow, and forces the user to use the redirect URL flow. (This is the flow used already for local configs.) In practice this will mean that instead of cutting and pasting a token for remote config, it will be necessary to run "rclone authorize" instead. This is how all the other OAuth backends work so it is a well tested code path. Fixes #6000 |
||
|---|---|---|
| .. | ||
| test | ||
| drive_internal_test.go | ||
| drive_test.go | ||
| drive.go | ||
| upload.go | ||