Hey Developer Community!
For those who don’t know me, I’m Dan, Engineering Manager on the Forge platform
I wanted to give some very early insight into a recent decision that we made about Forge. TL;DR: We’re removing user consent and individual users will no longer have to allow access to use an app. Instead, we will be relying on administrators to give consent on behalf of the users on their sites. We don’t have a timeline just yet.
Some context on what got us here:
A large reason why we are building Forge is to address security, trust, and compliance requirements in our customer’s journey to the cloud. We decided that Forge apps needed to use a fundamentally different method of authentication and authorization to what existed in Connect at the time. We needed more granular permissions and ultimately we wanted to provide more control to our customers. Forge opted to use OAuth 2.0 to achieve this.
Over the last two years, we’ve seen Forge evolve into a more mature platform. Since Forge has become generally available, we have seen many paid and free apps built on Forge and installed by 1000’s of customers. We also ran our annual Codegeist competition entirely on Forge. We’re at the stage where we are now looking to refine some of our core experiences to address any friction in Forge adoption.
We’ve seen quite a lot of feedback in relation to the “allow access” button shown for Forge apps. Some developers are asking for us to give controls to administrators to turn that off, some want it gone completely. We understand the risk this has for users onboarding to your apps. It’s a point of friction. We’ve experienced this friction internally with our own apps! Ironically, with an app that also helped us make this decision, that’s a story for another day .
Long story short, we’ve evaluated our requirements for individual user consent in collaboration with Legal, Privacy, PM, and Engineering and have found that it is not a requirement for Forge moving forward. We are now exploring the technical requirements to make this change and hope to share a timeline soon.