Able to generate Access token without client ID and secret using OAuth2 Password for Self-Hosted setup

How to Use GitLab
, ,
1

Hi All,

When using GitLab.com to generate Access token using Oauth2 Resource owner password credentials flow, the endpoint does not allow us to generate the Access Token without passing Client ID and Client Secret in HTTP Basic authentication.

Gitlab.com

When we try the same using Self-Hosted, we are able to generate the Access Token.

Self-Hosted

Wanted to know why there is difference in behavior? Also observed that the token generated for Self-Hosted does not belong to any app, the value is null. Below response when we hit /token/info

 {
   "resource_owner_id":2,
   "scope":[
      "api"
   ],
   "expires_in":null,
   "application":{
      "uid":null
   },
   "created_at":1612357739,
   "scopes":[
      "api"
   ],
   "expires_in_seconds":null
}

Thanks,
Mithun