X-Git-Url: http://git.squeep.com/?a=blobdiff_plain;f=docs%2Fdev.md;h=22e0691f14e35e906bbb4a1a546874e4d0606b77;hb=755f58168bb2b6b979c6f5d36f7eff56d2305911;hp=085d66760f7bc679528d064a20232df87525594e;hpb=a6d8cef33e9ac91c373d0ac4c96a42bd941fe6b2;p=akkoma diff --git a/docs/dev.md b/docs/dev.md index 085d66760..22e0691f1 100644 --- a/docs/dev.md +++ b/docs/dev.md @@ -16,7 +16,7 @@ This document contains notes and guidelines for Pleroma developers. ## [HTTP Basic Authentication](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Authorization) -* With HTTP Basic Auth, OAuth scopes check is _not_ performed for any action (since password is provided during the auth, requester is able to obtain a token with full permissions anyways). `Pleroma.Plugs.AuthenticationPlug` and `Pleroma.Plugs.LegacyAuthenticationPlug` both call `Pleroma.Web.Plugs.OAuthScopesPlug.skip_plug(conn)` when password is provided. +* With HTTP Basic Auth, OAuth scopes check is _not_ performed for any action (since password is provided during the auth, requester is able to obtain a token with full permissions anyways). `Pleroma.Web.Plugs.AuthenticationPlug` and `Pleroma.Web.Plugs.LegacyAuthenticationPlug` both call `Pleroma.Web.Plugs.OAuthScopesPlug.skip_plug(conn)` when password is provided. ## Auth-related configuration, OAuth consumer mode etc.