Authorized Application

When trying to "Destroy" (should use the word revoke) an application's API access, it leads to a 404 and doesn't remove the applications access to the API.

I am talking about here on gitlab.com (maybe this should be a different repository)?

The following page is what leads to a 404.

https://gitlab.com/profile/applications

Clicking "Destroy" for a application results in a 404 and API access is not revoked.

I have exactly the same problem. But I am Using the GitLab CE version hosted on a university server.
these are the current version of my components:
GitLab 8.6.4
GitLab Shell 2.6.12
GitLab API v3
Git 2.7.4
Ruby 2.1.8p440
Rails 4.2.5.2
PostgreSQL 9.2.15

Surprised this serious issue hasn't been addressed. Is this normally how security issues are treated on GitLab?

Added ~14106 label

Can one of you having this issue record a screencast of what happens? I just tried to add a new application and delete it, and it worked fine. Does the application need to be in the "Authorized applications" list?

@williamcheung Security issues are usually handled quickly if they are notified via security@gitlab.com. See: https://about.gitlab.com/disclosure/

Yes, it looks like if the application is under the "Authorized applications" list, the deletion does not work.

Hey Stan, yep, that's right. When I go to https://gitlab.com/profile/applications and click Destroy on an app under "Authorized applications", I get a 404. I added several apps for testing and now I can't revoke them and since they have api scope the devs can do whatever they want with my account I guess. So emailing security@gitlab.com is the way to report the issue?

@williamcheung for the time being if you absolutely need to revoke an application's ability to access your account, https://gitlab.com/oauth/authorized_applications works perfectly fine. I'm currently trying to figure out a fix right now.

mentioned in merge request !3689 (closed)

mentioned in merge request !3690 (merged)

Milestone changed to 8.6

@connorshea Awesome, the workaround works. Just it redirects to /profile/applications after the Revoke which is inconvenient for revoking multiple apps which I just did.

Status changed to closed by commit 0c082d5e

mentioned in commit 0c082d5e

mentioned in commit c7e384aa

mentioned in commit dd9ced0a

mentioned in commit 248c0624

Mentioned in commit pfjason/gitlab-ce@dd9ced0a