30

When you visit your profile on the tab Settings you'll find the option "Applications".

It lists the Applications you've granted access. Each Application has a button at the right hand side labelled: 'Remove'.

settings / application / button remove

The expectation is that when you click that button two things happen:

  • the granted access is revoked, aka the access_token is no longer valid
  • the application is removed from the list.

Based on observation I assume none of the mentioned actions happen, simply because clicking the button doesn't send any calls to the server. I could live with the application not being removed from my list but I'm less happy with my granted access not being revoked. If I want to revoke access because an app has gone rogue I rather not have to first file a bug or submit a ticket.

Just in case this is a browser issue: I'm on Chrome/Win10, tested with all Userscripts disabled.

Can this be looked at and fixed, if possible with some priority?

9
  • 2
    It's probably the same cause as meta.stackexchange.com/questions/369949/cannot-delete-a-login/… Sep 26, 2021 at 21:26
  • @SonictheAnonymousHedgehog yeah, that sounds similar. Useful to have it linked here. Thanks.
    – rene
    Sep 26, 2021 at 21:27
  • The above link says it was completed; the remove button did work ~2 weeks ago, after cleaning up I have nothing remaining that I wish to lose.
    – Rob
    Sep 26, 2021 at 21:45
  • 6
    The JavaScript included in the page requires each "Remove" button have an app-disallow class. None of the "Remove" buttons have that class. Running the following in the console should enable the buttons: $('#mainbar a[id][href="#"]:contains("Remove")').click(function(){if(!confirm('Are you sure you want to disallow this application?')) return;var toRemove = $(this).parents('.app');var appId = $(this).attr('id').substring('app-'.length);$.post(`/users/apps/de-authorize/${StackExchange.options.user.userId}`,{ fkey: StackExchange.options.user.fkey, appId},function(){toRemove.remove();});});
    – Makyen
    Sep 26, 2021 at 23:25
  • i.stack.imgur.com/HBWIf.gif replicated..... the position of the winterbash button is off too...
    – Journeyman Geek Mod
    Sep 27, 2021 at 1:18
  • ..... Lucky that didn't work actually....
    – Journeyman Geek Mod
    Sep 27, 2021 at 5:20
  • 5
    This has been added to be addressed as a part of regular bug duty rotation. It seems like an easy fix so hopefully it'll be picked up soon ^_^
    – JNat StaffMod
    Sep 27, 2021 at 17:58
  • 3
    @JNat nothing personal, but I've seen many cases where "hopefully it'll be picked up soon" or similar wording meant "never", and I mean never - not even 5, 6, 7, and 8 years after it was posted. Well my point is.... I'm skeptic about it. It's just a minor bug with no critical effect, so easy to be ignored. (by the devs who will always have something more important to fix) Nov 15, 2021 at 9:05
  • 1
    sigh I know I should expect 6-8 for everything on SE, but it's frustrating to see a bug which is a potential security issue (and which should be able to be fixed by merely adding class="app-disallow" to the HTML generated for each button) not be addressed for months. I know developer time is a scarce resource, but ... Oh, just sigh.
    – Makyen
    Dec 8, 2021 at 13:57

2 Answers 2

11
+50

We just looked up the definition of "prioritize" and it looks like we thought it meant something else! Sorry about that, this should have been addressed far quicker due to the nature of the bug.

Anyhow, I'm happy to announce this has finally been addressed and I was able to remove the authentication for the iOS app (which has been long dead) from my account.


Update 2022-05-09: A bug existed where whenever a user that belonged to one or more Teams tried accessing their authorized applications from a network site, they'd get a 500 error. For a bit of context, network sites have little to no access about Teams data for security and privacy reasons. So when a network site was trying to list out applications, it would try checking to see what Teams these applications had access to it. But because network sites don't know about Teams unless explicitly requested, it couldn't list out applications properly leading to this 500 error.

This has been fixed so network sites can request the minimum amount of data about Teams (i.e. teams and a URL), so that it can list those teams under the respective applications.


Outdated: Semi-related to this bug, if you receive a 500 error (pictured below) when trying to access your application settings, it's a known bug that needs to be fixed.

A screenshot of Stack Overflow's internal server error

A temporary workaround is to manage your applications via Stack Overflow and not another site. This server error occurs whenever a user tries to manage their applications via a non-Stack Overflow site and belongs to any Teams.

11
  • 2
    I'm very glad that this was resolved. I am, however, deeply concerned about a bug handling/prioritization process which doesn't assign something like this, which is a potential security issue, a significantly higher priority and shorter time to resolution.
    – Makyen
    Mar 31 at 3:21
  • 1
    Actually the iOS app still alive, some people still actually use it. (Not me, but e.g. Glorfindel, a local mod here) Mar 31 at 11:02
  • I'm not sure how you addressed it but for me the apps page ends in an "Oops something bad happened". I give you that none of my apps are therefor listed on that page and no remove button is shown, so that button can't be non-working either but this seems a bit of a rough fix. Can you please re-visit this and have another go at it? I'll be thankful.
    – rene
    Mar 31 at 16:52
  • Just be informed that the Oops! only happens as a normal users. Mods (and I assume staff) don't experience any issue, as confirmed by a mod in the MSE Tavern RO chat room.
    – rene
    Mar 31 at 17:14
  • 4
    @rene I can confirm that I see exceptions being thrown when trying to access your Application listing, let me investigate. The problem I addressed was the "Delete" button not functioning, the "Oops" error appears to be a separate issue. For the record, I tested with a separate non-mod/staff account and removing apps worked fine so not everyone appears to be affected.
    – allejo StaffMod
    Mar 31 at 18:03
  • That is an unfortunate regression then. Thanks for looking into it. Much appreciated.
    – rene
    Mar 31 at 18:55
  • 1
    @rene I promise I have not forgotten about this problem, things have just been busy these past few days. I've narrowed down the problem to occur whenever someone is on a non-Stack Overflow site and belongs to any Teams. In the meanwhile, if you look at your settings under Stack Overflow, you should be able to manage your applications on there.
    – allejo StaffMod
    Apr 5 at 17:50
  • 1
    @allejo Thanks, and yes I have confirmed that I can manage my Apps from my Stack Overflow profile. I removed one application successfully so that is a useful workaround.
    – rene
    Apr 5 at 20:22
  • 1
    @rene I told you I hadn't forgotten about this problem! It was just not an easy one to solve. But you should be able to access your API applications from network sites now!
    – allejo StaffMod
    May 9 at 17:54
  • 1
    @allejo I confirmed it works and the green checkmark should inform others this is resolved now. Your effort is appreciated.
    – rene
    May 9 at 18:11
  • @rene one can't buy f̶o̶o̶d̶ privileges with words only, where's the bounty? ;-) May 10 at 6:55
5
+100

As of now (until the devs get time to work on this), following code will assist in removing an application from your profile > settings > applications.

Extending the code provided by @Makyen, execute the following piece of code on your console for the basic version (executes deauth for respective app).

$.each($("#mainbar a[href='#']:contains('Remove')"), function(index, node) {
    $(node).attr('href', 'javascript:;');
    var userId = StackExchange.options.user.userId;
    $(node).click(function() {
        var params = {
            fkey: StackExchange.options.user.fkey,
            appId: $(this).attr('id').replace('app-', '')
        };
        $.post("/users/apps/de-authorize/" + userId, params, function() {
            $(node).parent().parent().parent().remove();
        });
    });
});

The fancy version is originally posted here at https://pastebin.com/7QZas8WK the one with the initial state that says: "You have no authorized applications". But also posted below:

// The fancy version
var appCount = 0;
var emptyBlock = '<div class="s-empty-state p48 bg-black-025 bar-md ba bc-black-075 ta-center"><svg aria-hidden="true" class="mb24 svg-spot spotEmptyLg" width="96" height="96" viewBox="0 0 96 96"><path d="M8 12a4 4 0 014-4h79a4 4 0 014 4v18a4 4 0 01-4 4H12a4 4 0 01-4-4V12zm0 33a4 4 0 014-4h79a4 4 0 014 4v18a4 4 0 01-4 4H12a4 4 0 01-4-4V45zM4 78.63a1.5 1.5 0 01-3 0V75.5A4.5 4.5 0 015.5 71h2.44a1.5 1.5 0 010 3H5.5c-.83 0-1.5.67-1.5 1.5v3.13zm9.27-6.13c0-.83.68-1.5 1.5-1.5h4.88a1.5 1.5 0 010 3h-4.88a1.5 1.5 0 01-1.5-1.5zm11.72 0c0-.83.67-1.5 1.5-1.5h4.88a1.5 1.5 0 110 3h-4.88a1.5 1.5 0 01-1.5-1.5zm11.71 0c0-.83.67-1.5 1.5-1.5h4.88a1.5 1.5 0 110 3H38.2a1.5 1.5 0 01-1.5-1.5zm11.72 0c0-.83.67-1.5 1.5-1.5h4.88a1.5 1.5 0 010 3h-4.88a1.5 1.5 0 01-1.5-1.5zm11.71 0c0-.83.67-1.5 1.5-1.5h4.88a1.5 1.5 0 010 3h-4.88a1.5 1.5 0 01-1.5-1.5zm11.72 0c0-.83.67-1.5 1.5-1.5h4.88a1.5 1.5 0 010 3h-4.88a1.5 1.5 0 01-1.5-1.5zm11.71 0c0-.83.67-1.5 1.5-1.5h2.44a4.5 4.5 0 014.5 4.5v3.13a1.5 1.5 0 01-3 0V75.5a1.5 1.5 0 00-1.5-1.5h-2.44a1.5 1.5 0 01-1.5-1.5zM2.5 85.88c.83 0 1.5.67 1.5 1.5v3.15A1.5 1.5 0 005.5 92h2.44a1.5 1.5 0 010 3H5.4A4.5 4.5 0 011 90.5v-3.13c0-.82.67-1.5 1.5-1.5zm88 0c.83 0 1.5.67 1.5 1.5v3.12a4.52 4.52 0 01-4.5 4.5h-2.44a1.5 1.5 0 010-3h2.44a1.5 1.5 0 001.5-1.5v-3.13c0-.82.67-1.5 1.5-1.5zM13.27 93.5c0-.83.68-1.5 1.5-1.5h4.88a1.5 1.5 0 010 3h-4.88a1.5 1.5 0 01-1.5-1.5zm11.72 0c0-.83.67-1.5 1.5-1.5h4.88a1.5 1.5 0 010 3h-4.88a1.5 1.5 0 01-1.5-1.5zm11.71 0c0-.83.67-1.5 1.5-1.5h4.88a1.5 1.5 0 110 3H38.2a1.5 1.5 0 01-1.5-1.5zm11.72 0c0-.83.67-1.5 1.5-1.5h4.88a1.5 1.5 0 010 3h-4.88a1.5 1.5 0 01-1.5-1.5zm11.71 0c0-.83.67-1.5 1.5-1.5h4.88a1.5 1.5 0 010 3h-4.88a1.5 1.5 0 01-1.5-1.5zm11.72 0c0-.83.67-1.5 1.5-1.5h4.88a1.5 1.5 0 010 3h-4.88a1.5 1.5 0 01-1.5-1.5z" opacity=".2"></path><path d="M14.5 18a2.5 2.5 0 100-5 2.5 2.5 0 0 0 0 5zm8.5-2.5c0-.83.67-1.5 1.5-1.5h57a1.5 1.5 0 010 3h-57a1.5 1.5 0 01-1.5-1.5zM5.5 1A4.5 4.5 0 001 5.5v20A4.5 4.5 0 005.5 30h81a4.5 4.5 0 004.5-4.5v-20A4.5 4.5 0 0086.5 1h-81zM4 5.5C4 4.67 4.67 4 5.5 4h81c.83 0 1.5.67 1.5 1.5v20c0 .83-.67 1.5-1.5 1.5h-81A1.5 1.5 0 014 25.5v-20zm13 43a2.5 2.5 0 11-5 0 2.5 2.5 0 0 1 5 0zm7.5-1.5a1.5 1.5 0 000 3h57a1.5 1.5 0 000-3h-57zm-19-13A4.5 4.5 0 001 38.5v20A4.5 4.5 0 005.5 63h81a4.5 4.5 0 004.5-4.5v-20a4.5 4.5 0 00-4.5-4.5h-81zM4 38.5c0-.83.67-1.5 1.5-1.5h81c.83 0 1.5.67 1.5 1.5v20c0 .83-.67 1.5-1.5 1.5h-81A1.5 1.5 0 014 58.5v-20z"></path></svg><div>You have no authorized applications</div></div>';
$.each($("#mainbar a[href='#']:contains('Remove')"),function(index, node){
    $(node).attr('href','javascript:;');
    appCount++;
    var userId = StackExchange.options.user.userId;
    $(node).click(function(){
        var params = {
            fkey: StackExchange.options.user.fkey,
            appId: $(this).attr('id').replace('app-','')
        };
        
        $.post("/users/apps/de-authorize/" + userId,params,function(){
            appCount--;
            if (appCount == 0) {
                $(node).parent().parent().parent().parent().append(emptyBlock);
            }
            $(node).parent().parent().parent().remove();
        });
    });
});

Thanks to @A.L for suggesting to add this as an answer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .