You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Giteabot f144521aea Deprecate query string auth tokens (#28390) (#28430) ... Backport #28390 by @jackHay22 ## Changes - Add deprecation warning to `Token` and `AccessToken` authentication methods in swagger. - Add deprecation warning header to API response. Example: ``` HTTP/1.1 200 OK ... Warning: token and access_token API authentication is deprecated ... ``` - Add setting `DISABLE_QUERY_AUTH_TOKEN` to reject query string auth tokens entirely. Default is `false` ## Next steps - `DISABLE_QUERY_AUTH_TOKEN` should be true in a subsequent release and the methods should be removed in swagger - `DISABLE_QUERY_AUTH_TOKEN` should be removed and the implementation of the auth methods in question should be removed ## Open questions - Should there be further changes to the swagger documentation? Deprecation is not yet supported for security definitions (coming in [OpenAPI Spec version 3.2.0](https://github.com/OAI/OpenAPI-Specification/issues/2506)) - Should the API router logger sanitize urls that use `token` or `access_token`? (This is obviously an insufficient solution on its own) Co-authored-by: Jack Hay <jack@allspice.io> Co-authored-by: delvh <dev.lh@web.de>		1 year ago
..
actions	chore(actions): support cron schedule task (#26655)	2 years ago
activitypub	More refactoring of `db.DefaultContext` (#27083)	2 years ago
analyze	Rename code_langauge.go to code_language.go (#26377)	2 years ago
assetfs	Use `Set[Type]` instead of `map[Type]bool/struct{}`. (#26804)	2 years ago
auth	Next round of `db.DefaultContext` refactor (#27089)	2 years ago
avatar	Remove nfnt/resize and oliamb/cutter (#25999)	2 years ago
base	Replace `interface{}` with `any` (#25686)	2 years ago
cache	improve unit test for caching (#26185)	2 years ago
charset	Replace `interface{}` with `any` (#25686)	2 years ago
container	Implement FSFE REUSE for golang files (#21840)	2 years ago
context	Add guide page to actions when there's no workflows (#28145) (#28153)	1 year ago
contexttest	Avoid double-unescaping of form value (#26853)	2 years ago
csv	Refactor locale number (#24134)	2 years ago
doctor	Improve doctor cli behavior (#28422) (#28424)	1 year ago
emoji	Update emoji set to Unicode 15 (#25595)	2 years ago
eventsource	More `db.DefaultContext` refactor (#27265) (#27347)	1 year ago
generate	Handle base64 decoding correctly to avoid panic (#26483)	2 years ago
git	Make gogit Repository.GetBranchNames consistent (#28348) (#28386)	1 year ago
gitgraph	More `db.DefaultContext` refactor (#27265) (#27347)	1 year ago
graceful	Allow the use of alternative net.Listener implementations by downstreams (#25855)	2 years ago
hcaptcha	Consume hcaptcha and pwn deps (#22610)	2 years ago
highlight	Upgrade go dependencies (#25819)	2 years ago
hostmatcher	Support allowed hosts for webhook to work with proxy (#27655) (#27675)	1 year ago
html	Refactor backend SVG package and add tests (#26335)	2 years ago
httpcache	Less naked returns (#25713)	2 years ago
httplib	Less naked returns (#25713)	2 years ago
indexer	Meilisearch: require all query terms to be matched (#28293) (#28296)	1 year ago
issue/template	Replace `interface{}` with `any` (#25686)	2 years ago
json	Replace `interface{}` with `any` (#25686)	2 years ago
label	Make label templates have consistent behavior and priority (#23749)	2 years ago
lfs	Refactor lfs requests (#26783)	2 years ago
log	Reduce some allocations in type conversion (#26772)	2 years ago
markup	Render email addresses as such if followed by punctuation (#27987) (#27992)	1 year ago
mcaptcha	Implement FSFE REUSE for golang files (#21840)	2 years ago
metrics	Reduce usage of `db.DefaultContext` (#27073)	2 years ago
migration	Replace `interface{}` with `any` (#25686)	2 years ago
nosql	Update tool dependencies, lock govulncheck and actionlint (#25655)	2 years ago
options	Use a general approach to access custom/static/builtin assets (#24022)	2 years ago
packages	Close all hashed buffers (#27787) (#27790)	1 year ago
paginator	Use more specific test methods (#24265)	2 years ago
pprof	Implement FSFE REUSE for golang files (#21840)	2 years ago
private	Replace `interface{}` with `any` (#25686)	2 years ago
process	Less naked returns (#25713)	2 years ago
proxy	Use proxy for pull mirror (#22771)	2 years ago
proxyprotocol	Implement FSFE REUSE for golang files (#21840)	2 years ago
public	Serve pre-defined files in "public", add "security.txt", add CORS header for ".well-known" (#25974)	2 years ago
queue	Increase queue length (#27555) (#27562)	1 year ago
recaptcha	Implement FSFE REUSE for golang files (#21840)	2 years ago
references	Replace 'userxx' with 'orgxx' in all test files when the user type is org (#27052)	2 years ago
regexplru	Upgrade go dependencies (#25819)	2 years ago
repository	Ignore "non-existing" errors when getDirectorySize calculates the size (#28276) (#28285)	1 year ago
secret	Improve decryption failure message (#24573)	2 years ago
session	Next round of `db.DefaultContext` refactor (#27089)	2 years ago
setting	Deprecate query string auth tokens (#28390) (#28430)	1 year ago
sitemap	Fix sitemap (#22272)	2 years ago
ssh	restrict certificate type for builtin SSH server (#26789)	2 years ago
storage	Fix object storage path handling (#27024)	2 years ago
structs	Fix package webhook (#27839) (#27855)	1 year ago
svg	Refactor backend SVG package and add tests (#26335)	2 years ago
sync	Implement FSFE REUSE for golang files (#21840)	2 years ago
system	Implement FSFE REUSE for golang files (#21840)	2 years ago
templates	Fix label render containing invalid HTML (#27752) (#27762)	1 year ago
test	Move web/api context related testing function into a separate package (#26859)	2 years ago
testlogger	Replace `interface{}` with `any` (#25686)	2 years ago
timeutil	Fix incorrect webhook time and use relative-time to display it (#24477)	2 years ago
translation	Replace `interface{}` with `any` (#25686)	2 years ago
turnstile	Add new captcha: cloudflare turnstile (#22369)	2 years ago
typesniffer	Detect ogg mime-type as audio or video (#26494)	2 years ago
updatechecker	Implement FSFE REUSE for golang files (#21840)	2 years ago
upload	Implement FSFE REUSE for golang files (#21840)	2 years ago
uri	Implement FSFE REUSE for golang files (#21840)	2 years ago
user	Implement FSFE REUSE for golang files (#21840)	2 years ago
util	Refactor lfs requests (#26783)	2 years ago
validation	Check blocklist for emails when adding them to account (#26812)	2 years ago
web	Make CORS work for oauth2 handlers (#28184) (#28185)	1 year ago
webhook	New webhook trigger for receiving Pull Request review requests (#24481)	2 years ago