Improving OAuth ROPC security on GitLab.com
Apr 1, 2025GitLab Security Team
Summary
GitLab.com will require client authentication for OAuth Resource Owner Password Credentials (ROPC) starting April 8, 2025. This change mandates the inclusion of `client_id` and `client_secret` in ROPC requests to enhance security, ensure standards compliance, and improve auditing. Existing integrations without client credentials will be disrupted. Users are instructed to register applications to obtain credentials and update their authentication requests.
More from the SAML Single Sign-On (SSO) Integration trail
- A leaked personal access token shouldn't expose every project its owner can reach. Fine-grained PATs scope each token’s permissions to the job.
- Passkeys now available for passwordless sign-in and 2FA on GitLab
- How to set up GitLab SAML SSO with Google Workspace
- Strengthening GitLab.com security: Mandatory MFA
- Automating role-based access control (RBAC) at scale