GitHub Authorization: OAuth vs. GitHub Apps

On my first day as an intern, I accidentally forked my organization's entire codebase into my personal GitHub account! Although this rookie mistake was short-lived, it left a lasting impression on me about the vast array of features and operations GitHub offers. Now, nine years and countless merge conflicts later, I still feel that my understanding of GitHub barely scratches the surface.

Today, let’s dive into one specific corner of this vast platform: GitHub authorization. Many of you are likely familiar with the “classic” personal access tokens (PATs) that can replace passwords for authentication, and two-factor authentication (2FA) for added security. However, this post will focus on authorizing third-party apps via GitHub.

Apps on GitHub

GitHub provides two main types of applications for integrating third-party services: OAuth Apps and GitHub Apps. While both methods enable external applications to interact with GitHub, their use cases and scope of permissions are quite different.

OAuth Apps

OAuth Apps are widely used when a third-party application needs access to perform actions on behalf of a user. The authorization flow is a standard OAuth 2.0 process, where users grant the app permission to access their GitHub data. Once approved, the app receives an access token to interact with the GitHub API on the user's behalf.

OAuth Authorization Flow:

1. User Consent: The user navigates to a specific GitHub URL to authorize the app and grant it access to their account.
2. Authorization Code: After granting permission, GitHub provides an authorization code to the third-party app.
3. Token Exchange: The app exchanges this authorization code for an access token and refresh token. The access token allows the app to make authenticated API requests on behalf of the user.
4. Token Expiry: When an access token expires, the refresh token allows the app to request a new access token without requiring user intervention again.

Key Benefits of OAuth Apps:

• Easy Integration: OAuth Apps provide a familiar, standardized way for users to authenticate third-party apps with their GitHub account.
• Cross-Platform Usability: OAuth is widely adopted across various platforms, making it convenient for developers who need to manage user permissions across multiple services.

Drawbacks of OAuth Apps:

While OAuth Apps are a convenient way to get started with GitHub integration, it is a security concern that it has access to all repositories the user has permission to view, without any granular control. This means a user cannot restrict the app to only a few repositories.

GitHub Apps

GitHub Apps, on the other hand, offer a more fine-tuned and flexible way to integrate with GitHub. These apps can either act on behalf of a user or operate independently. The granularity of permissions and event-driven functionality make GitHub Apps a preferred choice for building more complex integrations, especially for organizations.

GitHub App Authorization Flow:

1. Installation: Unlike OAuth Apps, GitHub Apps need to be installed in a specific account or organization. During installation, the owner or admin can define exactly which repositories or organization resources the app can access.
2. JWT-Based Authentication: Instead of long-lived tokens, GitHub Apps authenticate using JSON Web Tokens (JWT). The app generates a JWT that GitHub verifies, and in return, GitHub provides an Installation Access Token (IAT) with short-lived validity (typically one hour).
3. Fine-Grained Permissions: During installation, the admin can grant access to only the specific repositories the app needs to interact with, ensuring fine-grained control over the app’s scope.

Also Read Testing Popular Repositories: Using GoCodeo

‍

Key Benefits of GitHub Apps:

• Fine-Grained Permissions: GitHub Apps offer precise control over which repositories and resources the app can access. This stands in stark contrast to OAuth Apps, where access is broader.
• Webhook Support: GitHub Apps natively support webhooks, enabling real-time notifications for events like pushes, pull requests, or issue creation. This is especially valuable for apps that need to react to GitHub activity.
• Dynamic Rate Limits: GitHub Apps have dynamic rate limits based on how many repositories they are installed in. This means that the more repositories you install your app in, the higher your API rate limits will be, reducing the likelihood of throttling during periods of heavy usage.
• Independent Operation: Unlike OAuth Apps, GitHub Apps don’t always need to act on behalf of a user. Once installed, they can function independently, making them perfect for use cases like CI/CD integrations or automated bots.

Which One Should You Use?

The short answer is Github Apps since Github recommends it. GitHub Apps are perfect for complex integrations, such as those used in enterprise environments, where security, fine-grained control, and webhook support are crucial. GitHub Apps also offer better token management, short-lived tokens, and rate-limiting advantages, making them the go-to choice for modern GitHub integrations.
However, the support for GitHub Apps does not extend to all API endpoints. You will have to refer to the API documentation to ensure that the endpoint is accessible by GitHub App installation access tokens. Of course, you may have to use an intelligent combination of both if it suits your requirements best.

At GoCodeo, we understand the importance of code security and strive to achieve a balance between ease of access and privacy. When users log in, we employ OAuth apps to access their basic profile information and public repositories, enabling us to prepare their public repos for testing without delay. However, for private and organization repositories, we take a more secure approach by requiring explicit authorization through a GitHub App. This gives users complete control over which repos they want to test, allowing them to select specific repositories during installation. This dual approach ensures both flexibility and protection, while also benefiting from GitHub Apps' real-time webhook support and dynamic rate limits for efficient scaling.

Conclusion

We hope the lessons we learned from GitHub Authorization and Access Management were useful to you. Let us know if you have any questions in the comments and we’ll be happy to clarify them.

‍