mirror of https://github.com/go-gitea/gitea.git
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
7d855efb1f
The PKCE flow according to [RFC 7636](https://datatracker.ietf.org/doc/html/rfc7636) allows for secure authorization without the requirement to provide a client secret for the OAuth app. It is implemented in Gitea since #5378 (v1.8.0), however without being able to omit client secret. Since #21316 Gitea supports setting client type at OAuth app registration. As public clients are already forced to use PKCE since #21316, in this PR the client secret check is being skipped if a public client is detected. As Gitea seems to implement PKCE authorization correctly according to the spec, this would allow for PKCE flow without providing a client secret. Also add some docs for it, please check language as I'm not a native English speaker. Closes #17107 Closes #25047 |
2 years ago | |
---|---|---|
.. | ||
admin | 2 years ago | |
auth | 2 years ago | |
devtest | 2 years ago | |
events | 2 years ago | |
explore | 2 years ago | |
feed | 2 years ago | |
healthcheck | 2 years ago | |
misc | 2 years ago | |
org | 2 years ago | |
repo | 2 years ago | |
shared | 2 years ago | |
user | 2 years ago | |
auth.go | 2 years ago | |
auth_windows.go | 2 years ago | |
base.go | 2 years ago | |
goget.go | 2 years ago | |
home.go | 2 years ago | |
metrics.go | 2 years ago | |
nodeinfo.go | 2 years ago | |
swagger_json.go | 2 years ago | |
web.go | 2 years ago | |
webfinger.go | 2 years ago |