-
New Feature
-
Resolution: Unresolved
-
Normal
-
None
-
None
-
None
-
None
In https://github.com/metabrainz/critiquebrainz/pull/424/commits/b5c1132fc6d6be11ed99b1bf4e3ca568c3a7cdee we limited the callback URL for an oauth app to start with http:// or https://, in order to prevent malicious callback urls.
This means that a desktop/mobile app can no longer register a custom callback URL.
MusicBrainz allows users to create either a "website" app, or an "application" app. In the case of application, the callback url "protocol" must be a fqdn: https://github.com/metabrainz/musicbrainz-server/blob/e6cf1f7377e76f7e9dfabe11d69f6dbbe8c49800/lib/MusicBrainz/Server/Constants.pm#L990-L991 and an oauth app's type cannot be changed it is created.
This ticket may go away once we implement this functionality in the MeB website.