Add oAuth authentication for Bitbucket.

[afragen]

I'm going to need some help with this.

[yafred]

Hi Andy,

I don't think you can solve issue #322 like that (if this was your goal).
You should wait for Bitbucket application scoped tokens (similar to GitHub).

https://blog.bitbucket.org/2015/09/10/two-step-verification-is-here/ (search for working on a secure alternative to username/password credentials that can be used with scripts).

Until application tokens are implemented, you should recommend using a 2nd Bitbucket userid without two step authentication and limited rights on the repositories (read only).

[afragen]

@yafred I'm eagerly awaiting Bitbucket creation and usage of application specific tokens, a la GitHub, https://bitbucket.org/site/master/issues/11774/application-specific-passwords-or-tokensApplication%20specific%20passwords

Presently, unless someone has physical access to the computer you use for managing GitHub Updater, they would have to be packet sniffing to find a hash of your Bitbucket user/pass and then decrypt that hash.

I do agree that the security conscious should create an additional Bitbucket user that only has read-only access to the the repositories.

[cdCorey]

Bitbucket has supported a feature called deployment keys for at least a few months now. Isn't that what you're looking for?

[afragen]

No, deployment keys are SSH keys and what we need has to work over HTTPS

[benoitchantre]

Here are some docs I have found on the subject:

• Blog article: Bitbucket now supports OAuth2 and fine-grained scopes for resources
• Documentation: OAuth on Bitbucket Cloud
• Tutorial: Atlassian 3-legged OAuth Example
• Project: bitbucket-backup

The last item (bitbucket-backup) seems to be a good and concise example.

[afragen]

With WP 4.6 and AJAXy updates this is more important. There's currently a fix in place but only a single private Bitbucket update per page load will work.

I think the solution lies in integration with https://github.com/stevenmaguire/oauth2-bitbucket so that oAuth 2 tokens may be used with the download URI.

https://developer.atlassian.com/bitbucket/concepts/oauth2.html

http://stackoverflow.com/questions/34452088/retrieving-single-raw-file-from-bitbucket-with-token-based-authentication?noredirect=1&lq=1

[scofennell]

Hi Andy,

To your point,

I'm eagerly awaiting Bitbucket creation and usage of application specific tokens

I suspect you are aware of the "App Passwords" feature that Bitbucket shipped earlier this year: https://blog.bitbucket.org/2016/06/06/app-passwords-bitbucket-cloud/

Is that what you had in mind with your comment?

If so, could you clarify why the app passwords feature is any more secure that the current username/password basic auth?

[afragen]

@scofennell these app passwords are a step in the right direction from Bitbucket but still doesn't make it as simple as GitHub or GItLab does with an access token. These app passwords are much better in that you can create a read-only password and use that with your username.

Basic Auth in Bitbucket sends a Base64 encoded hash of your user/pass in an HTTP header. Having a read only password significantly limits the access anyone potentially sniffing you HTTP traffic can cause.

https://github.com/afragen/github-updater/blob/develop/src/GitHub_Updater/Bitbucket_API.php#L433

Similarly the access token for GitHub could be sniffed in a similar manner. This isn't oAuth, but from Bitbucket it's a big step forword.

[scofennell]

Thanks Andy!

But is there a security advantage to using an app password as opposed to a username/password, where that user has read only priveleges?

I suppose with the latter, you'd be able to actually log in to bitbucket.com in addition to making API calls, but that doesn't seem like much of a functional security difference to me. Am I missing something?

[afragen]

Yes, there is an advantage to creating a read-only Bitbucket app password. GitHub Updater only requires read-only permissions. Bitbucket created app passwords for users who have 2FA set on so they could functionally use services like GHU.

I don't have 2FA set but I do have a read-only app password that I use with GHU.

If you have 2FA set up for Bitbucket then no one should be able to access your account if they could determine your username/app_password.

To specifically answer your question regarding a user that only has read-only privileges, functionally I don't think there is a difference. You just don't need to create an additional user.

[afragen]

https://bitbucket.org/site/master/issues/11774/application-specific-passwords-or-tokens#comment-33186137

[scofennell]

I've been on a similar path with an updater plugin of my own, resulting in this feature request, which you might find worth monitoring:

https://bitbucket.org/site/master/issues/13690/customer-request-api-20-to-include

[dansarn]

I think there have been some updates made over at Bitbucket now that will put this issue on other roads. Latest update on https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html was made september 13, 2017 and now there is a way to create a Key and Secret for "OAuth integrated applications".

I don't think i'm able to solve this matter at this moment, since i'm still too new working with API-calls.