Work in progress.

A collection of UX enhancements for the authorize-application.php screen, with a particular focus on hardening against phishing.

• Greatly increase clarity about the target URL that will receive credentials if the request is approved
  • Shows the target host name front and centre without the rest of the URL
  • Gates approval behind a checkbox
• Removes support for username:password@ credentials in URLs
  • These are almost exclusively used for phishing
  • Despite being deprecated in modern browsers for many years, they're still technically functional, but there is no need to support them
• Removes support for reject URLs
  • If a user rejects approval, it is unexpected that they still get sent to the requesting site
  • This is an open redirect that can still result in phishing
  • Replaces the redirect with a message stating that the request was not approved
• Adds a "Copy" button to the generated application password after approval
  • Matches the one used on the Application Passwords section of the user profile screen

Screenshots