github-forks
/
gitea
mirror of https://github.com/go-gitea/gitea.git
1
0
Fork 0
Code Projects Releases Activity
gitea/templates
History
Jack Hay 4e879fed90
Deprecate query string auth tokens () 
## Changes
- Add deprecation warning to `Token` and `AccessToken` authentication
methods in swagger.
- Add deprecation warning header to API response. Example: 
  ```
  HTTP/1.1 200 OK
  ...
  Warning: token and access_token API authentication is deprecated
  ...
  ```
- Add setting `DISABLE_QUERY_AUTH_TOKEN` to reject query string auth
tokens entirely. Default is `false`

## Next steps
- `DISABLE_QUERY_AUTH_TOKEN` should be true in a subsequent release and
the methods should be removed in swagger
- `DISABLE_QUERY_AUTH_TOKEN` should be removed and the implementation of
the auth methods in question should be removed

## Open questions
- Should there be further changes to the swagger documentation?
Deprecation is not yet supported for security definitions (coming in
[OpenAPI Spec version
3.2.0](https://github.com/OAI/OpenAPI-Specification/issues/2506))
- Should the API router logger sanitize urls that use `token` or
`access_token`? (This is obviously an insufficient solution on its own)

---------

Co-authored-by: delvh <dev.lh@web.de>
..
admin Remove autofocus in search box ()
api/packages/pypi Remove incorrect HTML self close tag ()
base Rename the default themes to gitea-light, gitea-dark, gitea-auto ()
code Remove autofocus in search box ()
custom Add footer extra links template ()
devtest Improve dropdown button alignment and fix hover bug ()
explore Keep profile tab when clicking on Language ()
mail Update team invitation email link ()
org Issue fixes for RSS feed improvements ()
package Let `curl` write the content to file ()
projects Use full width for project boards ()
repo Issue fixes for RSS feed improvements ()
shared Refactor template empty checks ()
status Clean up template locale usage ()
swagger Deprecate query string auth tokens ()
user Improve text in Security settings ()
webhook Extract common code to new template ()
home.tmpl Fix more "locale" usages ()
install.tmpl Fix more "locale" usages ()
post-install.tmpl Always use `ctx.Locale.Tr` inside templates ()