Raised as CRF-10 in the round-3 review of #28179, deliberately deferred rather than fixed there.
site/static/oauth2allow.html renders the negotiated scope as #scope-list, which has no upper bound on length. body flex-centers .container inside a viewport-height parent with align-items: center, and .container has no overflow-y: auto. A grant with enough scope names could therefore push the Allow and Cancel buttons below the fold, on the one page where the user has to be able to reach them.
Unverified by rendering. The reviewer reasoned from the stylesheet rather than from a screenshot, so the first step is to establish at what list length (if any) the buttons actually leave the viewport, at a realistic minimum window height.
If it does reproduce, the fix is a scroll container on the list or on .container rather than a cap on the number of scopes shown: truncating the list on a consent page would hide permissions the user is being asked to approve, which is worse than scrolling.
Related: #28179, and CRF-3 (scope names carry no user-facing description) which touches the same block.
Refs PLAT-479.
Raised as CRF-10 in the round-3 review of #28179, deliberately deferred rather than fixed there.
site/static/oauth2allow.htmlrenders the negotiated scope as#scope-list, which has no upper bound on length.bodyflex-centers.containerinside a viewport-height parent withalign-items: center, and.containerhas nooverflow-y: auto. A grant with enough scope names could therefore push the Allow and Cancel buttons below the fold, on the one page where the user has to be able to reach them.Unverified by rendering. The reviewer reasoned from the stylesheet rather than from a screenshot, so the first step is to establish at what list length (if any) the buttons actually leave the viewport, at a realistic minimum window height.
If it does reproduce, the fix is a scroll container on the list or on
.containerrather than a cap on the number of scopes shown: truncating the list on a consent page would hide permissions the user is being asked to approve, which is worse than scrolling.Related: #28179, and CRF-3 (scope names carry no user-facing description) which touches the same block.
Refs PLAT-479.