You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Giteabot f144521aea Deprecate query string auth tokens (#28390) (#28430) ... Backport #28390 by @jackHay22 ## Changes - Add deprecation warning to `Token` and `AccessToken` authentication methods in swagger. - Add deprecation warning header to API response. Example: ``` HTTP/1.1 200 OK ... Warning: token and access_token API authentication is deprecated ... ``` - Add setting `DISABLE_QUERY_AUTH_TOKEN` to reject query string auth tokens entirely. Default is `false` ## Next steps - `DISABLE_QUERY_AUTH_TOKEN` should be true in a subsequent release and the methods should be removed in swagger - `DISABLE_QUERY_AUTH_TOKEN` should be removed and the implementation of the auth methods in question should be removed ## Open questions - Should there be further changes to the swagger documentation? Deprecation is not yet supported for security definitions (coming in [OpenAPI Spec version 3.2.0](https://github.com/OAI/OpenAPI-Specification/issues/2506)) - Should the API router logger sanitize urls that use `token` or `access_token`? (This is obviously an insufficient solution on its own) Co-authored-by: Jack Hay <jack@allspice.io> Co-authored-by: delvh <dev.lh@web.de>		1 year ago
..
config	Refactor system setting (#27000) (#27452)	1 year ago
actions.go	Make Actions tasks/jobs timeouts configurable by the user (#27400) (#27402)	1 year ago
actions_test.go	Restrict `[actions].DEFAULT_ACTIONS_URL` to only `github` or `self` (#25581)	2 years ago
admin.go	Refactor the setting to make unit test easier (#22405)	2 years ago
api.go	Refactor the setting to make unit test easier (#22405)	2 years ago
asset_dynamic.go	Use a general approach to access custom/static/builtin assets (#24022)	2 years ago
asset_static.go	Use a general approach to access custom/static/builtin assets (#24022)	2 years ago
attachment.go	Fix incorrect default value of `[attachment].MAX_SIZE` (#28373) (#28376)	1 year ago
attachment_test.go	Fix all possible setting error related storages and added some tests (#23911)	2 years ago
cache.go	Refactor the setting to make unit test easier (#22405)	2 years ago
camo.go	Refactor the setting to make unit test easier (#22405)	2 years ago
config.go	Refactor system setting (#27000) (#27452)	1 year ago
config_env.go	Fix `environment-to-ini` inherited key bug (#27543) (#27546)	1 year ago
config_env_test.go	Fix `environment-to-ini` inherited key bug (#27543) (#27546)	1 year ago
config_provider.go	Fix INI parsing for value with trailing slash (#26995)	2 years ago
config_provider_test.go	Fix INI parsing for value with trailing slash (#26995)	2 years ago
cors.go	Fix incorrect CORS default values (#24206)	2 years ago
cron.go	Replace `interface{}` with `any` (#25686)	2 years ago
cron_test.go	Rewrite queue (#24505)	2 years ago
database.go	Use `filepath` instead of `path` to create SQLite3 database file (#28374) (#28378)	1 year ago
database_sqlite.go	Implement FSFE REUSE for golang files (#21840)	2 years ago
database_test.go	Fix incorrect pgsql conn builder behavior (#28085) (#28098)	1 year ago
federation.go	Refactor the setting to make unit test easier (#22405)	2 years ago
git.go	Use `[git.config]` for reflog cleaning up (#24958)	2 years ago
git_test.go	Use `[git.config]` for reflog cleaning up (#24958)	2 years ago
highlight.go	Refactor the setting to make unit test easier (#22405)	2 years ago
i18n.go	Refactor the setting to make unit test easier (#22405)	2 years ago
incoming_email.go	Refactor the setting to make unit test easier (#22405)	2 years ago
indexer.go	Allow skipping forks and mirrors from being indexed (#23187)	2 years ago
indexer_test.go	Implement FSFE REUSE for golang files (#21840)	2 years ago
lfs.go	Handle base64 decoding correctly to avoid panic (#26483)	2 years ago
lfs_test.go	Display deprecated warning in admin panel pages as well as in the log file (#26094)	2 years ago
log.go	Clarify the logger's MODE config option (#26267)	2 years ago
log_test.go	Replace `interface{}` with `any` (#25686)	2 years ago
mailer.go	Make mailer SMTP check have timed context (#24751)	2 years ago
mailer_test.go	Remove unnecessary code (#24610)	2 years ago
markup.go	Add .livemd as a markdown extension (#22730)	2 years ago
metrics.go	Refactor the setting to make unit test easier (#22405)	2 years ago
migrations.go	Refactor the setting to make unit test easier (#22405)	2 years ago
mime_type_map.go	Refactor the setting to make unit test easier (#22405)	2 years ago
mirror.go	Avoid polluting the config (#25345)	2 years ago
oauth2.go	Handle base64 decoding correctly to avoid panic (#26483)	2 years ago
other.go	Refactor `setting.Other` and remove unused `SHOW_FOOTER_BRANDING` (#24270)	2 years ago
packages.go	Avoid creating directories when loading config (#25944)	2 years ago
packages_test.go	Fix all possible setting error related storages and added some tests (#23911)	2 years ago
path.go	Update path related documents (#25417)	2 years ago
path_test.go	Refactor path & config system (#25330)	2 years ago
picture.go	Fix all possible setting error related storages and added some tests (#23911)	2 years ago
project.go	Refactor the setting to make unit test easier (#22405)	2 years ago
proxy.go	Refactor the setting to make unit test easier (#22405)	2 years ago
queue.go	Increase queue length (#27555) (#27562)	1 year ago
repository.go	Change default size of attachments and repo files (#28100) (#28106)	1 year ago
repository_archive.go	Fix all possible setting error related storages and added some tests (#23911)	2 years ago
repository_archive_test.go	Fix all possible setting error related storages and added some tests (#23911)	2 years ago
security.go	Deprecate query string auth tokens (#28390) (#28430)	1 year ago
server.go	Serve pre-defined files in "public", add "security.txt", add CORS header for ".well-known" (#25974)	2 years ago
service.go	Add reverseproxy auth for API back with default disabled (#26703)	2 years ago
service_test.go	Fix allowed user types setting problem (#26200)	2 years ago
session.go	Use secure cookie for HTTPS sites (#26999)	2 years ago
setting.go	Make "install page" respect environment config (#25648)	2 years ago
setting_test.go	Implement FSFE REUSE for golang files (#21840)	2 years ago
ssh.go	Expanded minimum RSA Keylength to 3072 (#26604)	2 years ago
storage.go	Fix storage path logic especially for relative paths (#26441)	2 years ago
storage_test.go	Fix storage path logic especially for relative paths (#26441)	2 years ago
task.go	handle deprecated settings (#22992)	2 years ago
time.go	Remove unused setting `time.FORMAT` (#24430)	2 years ago
ui.go	Remove the service worker (#25010)	2 years ago
webhook.go	Refactor the setting to make unit test easier (#22405)	2 years ago