mirror of
https://github.com/pocket-id/pocket-id.git
synced 2026-05-04 18:00:38 +03:00
🐛 Bug Report: New OIDC clients by default are accessible by everyone with Pocket-ID access #566
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @peterforeman on GitHub (Dec 12, 2025).
Reproduction steps
When I create a new OIDC client you don't get the option to select the Usergroups who should have access to this resource. This is only shown after you've saved the new OIDC client.
If you don't then add a usergroup for access to this resource, by default everyone that has OIDC access also has access to this resource.
Expected behavior
Security-wise I would assume users by default won't get access to anything unless specifically stated (by adding them to a group and adding that group to the resource). I know it's stated in the text ("if you don't add any groups everybody has access") but it easily overlooked.
I want to propose that by default nobody has access, unless they're in an added group.
Actual Behavior
By default, everyone has access to a newly created OIDC client.
Pocket ID Version
1.16.0
Database
SQLite
OS and Environment
Kubernetes
Log Output
Not relevant.
@MarkusThielker commented on GitHub (Dec 12, 2025):
Since I believe this is the intended behavior right now, I am not sure if this actually qualifies as a bug.
Changing this behavior has already been proposed in #1052.
@peterforeman commented on GitHub (Dec 12, 2025):
You're right, I must have overlooked #1052 but do fully agree with it. This then can be closed, and I support #1052 to change this. I'm convinced it's bad practice to use a default allow strategy and in my case, we've already encountered misconfiguration because of this. Also because the top "save" button doesn't save changes to the group assignment (you must use the lower "save" button for this).