You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Jack Hay 4e879fed90 Deprecate query string auth tokens (#28390) ... ## Changes - Add deprecation warning to `Token` and `AccessToken` authentication methods in swagger. - Add deprecation warning header to API response. Example: ``` HTTP/1.1 200 OK ... Warning: token and access_token API authentication is deprecated ... ``` - Add setting `DISABLE_QUERY_AUTH_TOKEN` to reject query string auth tokens entirely. Default is `false` ## Next steps - `DISABLE_QUERY_AUTH_TOKEN` should be true in a subsequent release and the methods should be removed in swagger - `DISABLE_QUERY_AUTH_TOKEN` should be removed and the implementation of the auth methods in question should be removed ## Open questions - Should there be further changes to the swagger documentation? Deprecation is not yet supported for security definitions (coming in [OpenAPI Spec version 3.2.0](https://github.com/OAI/OpenAPI-Specification/issues/2506)) - Should the API router logger sanitize urls that use `token` or `access_token`? (This is obviously an insufficient solution on its own) --------- Co-authored-by: delvh <dev.lh@web.de>		1 year ago
..
actions	Use db.Find instead of writing methods for every object (#28084)	1 year ago
agit	Penultimate round of `db.DefaultContext` refactor (#27414)	1 year ago
asymkey	Use db.Find instead of writing methods for every object (#28084)	1 year ago
attachment	Even more `db.DefaultContext` refactor (#27352)	1 year ago
auth	Deprecate query string auth tokens (#28390)	1 year ago
automerge	Improve queue and logger context (#24924)	2 years ago
context	Another round of `db.DefaultContext` refactor (#27103)	1 year ago
convert	Fix package webhook (#27839)	1 year ago
cron	Actually recover from a panic in cron task (#28409)	1 year ago
externalaccount	Final round of `db.DefaultContext` refactor (#27587)	1 year ago
feed	More `db.DefaultContext` refactor (#27265)	1 year ago
forms	Fix required error for token name (#28267)	1 year ago
gitdiff	Even more `db.DefaultContext` refactor (#27352)	1 year ago
indexer	Fix missing issue search index update when changing status (#28325)	1 year ago
issue	Penultimate round of `db.DefaultContext` refactor (#27414)	1 year ago
lfs	Remove GetByBean method because sometimes it's danger when query condition parameter is zero and also introduce new generic methods (#28220)	1 year ago
mailer	Fix missing mail reply address (#27997)	1 year ago
markup	make writing main test easier (#27270)	1 year ago
migrations	Second part of refactor `db.Find` (#28194)	1 year ago
mirror	Even more `db.DefaultContext` refactor (#27352)	1 year ago
notify	Update status and code index after changing the default branch (#27018)	1 year ago
org	Delete repos of org when purge delete user (#27273)	1 year ago
packages	Fix RPM/Debian signature key creation (#28352)	1 year ago
pull	Remove GetByBean method because sometimes it's danger when query condition parameter is zero and also introduce new generic methods (#28220)	1 year ago
release	Fix comment permissions (#28213)	1 year ago
repository	Second part of refactor `db.Find` (#28194)	1 year ago
secrets	Use db.Find instead of writing methods for every object (#28084)	1 year ago
task	Fix incorrect ctx usage in defer function (#27740)	1 year ago
uinotification	Penultimate round of `db.DefaultContext` refactor (#27414)	1 year ago
user	Use db.Find instead of writing methods for every object (#28084)	1 year ago
webhook	Use db.Find instead of writing methods for every object (#28084)	1 year ago
wiki	Even more `db.DefaultContext` refactor (#27352)	1 year ago