Prefer making OAuth2 logins visible #2198

kcuasay commented 2025年11月04日 21:26:01 +01:00

Description

Currently, Codeberg supports GitHub and GitLab as IdPs, which makes creating an account for the user an easy, and, arguably, more secure experience. However, those IdPs are hidden and are only revealed after expanding the Sign in with ... drop down. Taking a glance at the relevant template and at commit Codeberg-Infrastructure/forgejo@79c18820b4, it appears this is an intentional design choice. For the users who had noticed, this can come off as a bit strange, as IdPs are typically made visible to the user rather than hidden. While for the ones who did not notice and are signing up for the first time, it can feel a bit annoying for them because it would mean yet another username/password to manage and 2FA to enroll.

Therefore, I'm interested to know a bit of background on that design choice, and why IdPs are intentionally being discouraged to use as sign in options.

### Description Currently, Codeberg supports GitHub and GitLab as IdPs, which makes creating an account for the user an easy, and, arguably, more secure experience. However, those IdPs are hidden and are only revealed after expanding the `Sign in with ...` drop down. [Taking a glance at the relevant template](https://codeberg.org/Codeberg-Infrastructure/forgejo/src/commit/2d1ffdaaa49e99679ce31ba75c76a3b999c063c9/templates/user/auth/oauth_container.tmpl#L7) and at commit https://codeberg.org/Codeberg-Infrastructure/forgejo/commit/79c18820b44c90c58a700d5b1b021bca4920c972, it appears this is an _intentional_ design choice. For the users who had noticed, this can come off as a bit strange, as IdPs are typically made visible to the user rather than hidden. While for the ones who did _not_ notice and are signing up for the first time, it can feel a bit annoying for them because it would mean yet another username/password to manage and 2FA to enroll. Therefore, I'm interested to know a bit of background on that design choice, and why IdPs are intentionally being discouraged to use as sign in options.

Gusted commented 2025年11月07日 00:36:53 +01:00

As you noted this is a intentional choice, we do not wish to promote using Github or Gitlab accounts to login to Codeberg. You will be tied to their platforms when doing that. CC @fnetX in case you also have a perspective on this.

As you noted this is a intentional choice, we do not wish to promote using Github or Gitlab accounts to login to Codeberg. You will be tied to their platforms when doing that. CC @fnetX in case you also have a perspective on this.