mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-09 21:10:59 +00:00
Marc-André Bombeck
d1fcbca63b
Dynamic client registration is open by specification and the client names itself, so anyone could register under a well-known assistant's name with a callback on a host of their own and send a signed-in person the authorize link. The consent page showed the borrowed name and "Unverified application", never where the code would be sent. Every consent page now says where the access goes: the callback's host, or an application on this device for a loopback callback, and the Allow button names the host. For a self-registered client whose callback leaves the device, a warning that names the host leads the page, above the self-reported name. Registration stays open: the hosted assistants register this way with their own https callback.