Move OSM authentication to OAuth 2.0

[pnorman]

OAuth 1.0a is deprecated, and programs which use it to authenticate requests to OpenStreetMap should move to OAuth 2.0. A date has not yet been set for turning off OAuth 1.0a and HTTP Basic.

It's best to move to OAuth 2.0 well in advance of any turn-off, because users may take some time to upgrade software and to re-authenticate.

See openstreetmap/operations#867 for details.

[jbelien]

Hello @pnorman ,

Thanks for the notice.
I believe OSM Welcome Tool is already using OAuth 2.0.

Is there something that make you think otherwise ?
If so, I'll be happy to make the necessary changes.

Thanks!

[danieldegroot2]

• osm-welcome-tool/config/packages/framework.yaml

  Line 21 in ec3a3a9

  base_uri: '%osm.api.url%'

• • osm-welcome-tool/config/services.yaml

    Line 9 in ec3a3a9

    osm.api.url: 'https://api.openstreetmap.org/api/0.6/'

Note, api.openstreetmap.org API url currently can not do OAuth 2 handshake. See openstreetmap/operations#951 (comment)
You can split the www. base URL and api. API url. See osmlab/osm-auth#123 (comment)

---

Only forks should still have to update to the current (application) version to get these changes.

[pnorman]

I believe OSM Welcome Tool is already using OAuth 2.0

I didn't find it in a quick code search, but if it is, that's good.

[danieldegroot2]

@pnorman Yes, it is. Your results may vary depending on what you search.
In this case, it is not using openstreetmap.org URL directly. It is using jbelien/oauth2-openstreetmap.

See https://github.com/jbelien/oauth2-openstreetmap/blob/master/src/Provider/OpenStreetMap.php