You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Jack Hay 4e879fed90 Deprecate query string auth tokens (#28390) ... ## Changes - Add deprecation warning to `Token` and `AccessToken` authentication methods in swagger. - Add deprecation warning header to API response. Example: ``` HTTP/1.1 200 OK ... Warning: token and access_token API authentication is deprecated ... ``` - Add setting `DISABLE_QUERY_AUTH_TOKEN` to reject query string auth tokens entirely. Default is `false` ## Next steps - `DISABLE_QUERY_AUTH_TOKEN` should be true in a subsequent release and the methods should be removed in swagger - `DISABLE_QUERY_AUTH_TOKEN` should be removed and the implementation of the auth methods in question should be removed ## Open questions - Should there be further changes to the swagger documentation? Deprecation is not yet supported for security definitions (coming in [OpenAPI Spec version 3.2.0](https://github.com/OAI/OpenAPI-Specification/issues/2506)) - Should the API router logger sanitize urls that use `token` or `access_token`? (This is obviously an insufficient solution on its own) --------- Co-authored-by: delvh <dev.lh@web.de>		1 year ago
..
config	Refactor system setting (#27000)	1 year ago
actions.go	add skip ci functionality (#28075)	1 year ago
actions_test.go	Restrict `[actions].DEFAULT_ACTIONS_URL` to only `github` or `self` (#25581)	2 years ago
admin.go	Refactor the setting to make unit test easier (#22405)	2 years ago
api.go	Refactor the setting to make unit test easier (#22405)	2 years ago
asset_dynamic.go	Use a general approach to access custom/static/builtin assets (#24022)	2 years ago
asset_static.go	Use a general approach to access custom/static/builtin assets (#24022)	2 years ago
attachment.go	Fix incorrect default value of `[attachment].MAX_SIZE` (#28373)	1 year ago
attachment_test.go	Fix all possible setting error related storages and added some tests (#23911)	2 years ago
cache.go	Refactor the setting to make unit test easier (#22405)	2 years ago
camo.go	Refactor the setting to make unit test easier (#22405)	2 years ago
config.go	Refactor system setting (#27000)	1 year ago
config_env.go	Fix `environment-to-ini` inherited key bug (#27543)	1 year ago
config_env_test.go	Fix `environment-to-ini` inherited key bug (#27543)	1 year ago
config_provider.go	Remove redundant `len` check around loop (#27464)	1 year ago
config_provider_test.go	Fix INI parsing for value with trailing slash (#26995)	1 year ago
cors.go	Fix incorrect CORS default values (#24206)	2 years ago
cron.go	Replace `interface{}` with `any` (#25686)	2 years ago
cron_test.go	Rewrite queue (#24505)	2 years ago
database.go	Use `filepath` instead of `path` to create SQLite3 database file (#28374)	1 year ago
database_sqlite.go	Implement FSFE REUSE for golang files (#21840)	2 years ago
database_test.go	Fix incorrect pgsql conn builder behavior (#28085)	1 year ago
federation.go	Refactor the setting to make unit test easier (#22405)	2 years ago
git.go	Use `[git.config]` for reflog cleaning up (#24958)	2 years ago
git_test.go	Use `[git.config]` for reflog cleaning up (#24958)	2 years ago
highlight.go	Refactor the setting to make unit test easier (#22405)	2 years ago
i18n.go	Refactor the setting to make unit test easier (#22405)	2 years ago
incoming_email.go	Refactor the setting to make unit test easier (#22405)	2 years ago
indexer.go	Allow skipping forks and mirrors from being indexed (#23187)	2 years ago
indexer_test.go	Implement FSFE REUSE for golang files (#21840)	2 years ago
lfs.go	Handle base64 decoding correctly to avoid panic (#26483)	2 years ago
lfs_test.go	Display deprecated warning in admin panel pages as well as in the log file (#26094)	2 years ago
log.go	Clarify the logger's MODE config option (#26267)	2 years ago
log_test.go	Replace `interface{}` with `any` (#25686)	2 years ago
mailer.go	Make mailer SMTP check have timed context (#24751)	2 years ago
mailer_test.go	Remove unnecessary code (#24610)	2 years ago
markup.go	Add .livemd as a markdown extension (#22730)	2 years ago
metrics.go	Refactor the setting to make unit test easier (#22405)	2 years ago
migrations.go	Refactor the setting to make unit test easier (#22405)	2 years ago
mime_type_map.go	Refactor the setting to make unit test easier (#22405)	2 years ago
mirror.go	Avoid polluting the config (#25345)	2 years ago
oauth2.go	Pre-register OAuth application for tea (#27509)	1 year ago
other.go	Refactor `setting.Other` and remove unused `SHOW_FOOTER_BRANDING` (#24270)	2 years ago
packages.go	Avoid creating directories when loading config (#25944)	2 years ago
packages_test.go	Fix all possible setting error related storages and added some tests (#23911)	2 years ago
path.go	Update path related documents (#25417)	2 years ago
path_test.go	Refactor path & config system (#25330)	2 years ago
picture.go	Fix all possible setting error related storages and added some tests (#23911)	2 years ago
project.go	Refactor the setting to make unit test easier (#22405)	2 years ago
proxy.go	Refactor the setting to make unit test easier (#22405)	2 years ago
queue.go	Increase queue length (#27555)	1 year ago
repository.go	Change default size of attachments and repo files (#28100)	1 year ago
repository_archive.go	Fix all possible setting error related storages and added some tests (#23911)	2 years ago
repository_archive_test.go	Fix all possible setting error related storages and added some tests (#23911)	2 years ago
security.go	Deprecate query string auth tokens (#28390)	1 year ago
server.go	Remove some dead code (#27196)	1 year ago
service.go	Add reverseproxy auth for API back with default disabled (#26703)	1 year ago
service_test.go	Fix allowed user types setting problem (#26200)	2 years ago
session.go	Use secure cookie for HTTPS sites (#26999)	1 year ago
setting.go	Make "install page" respect environment config (#25648)	2 years ago
setting_test.go	Implement FSFE REUSE for golang files (#21840)	2 years ago
ssh.go	Expanded minimum RSA Keylength to 3072 (#26604)	1 year ago
storage.go	Support storage base path as prefix (#27827)	1 year ago
storage_test.go	Support storage base path as prefix (#27827)	1 year ago
task.go	handle deprecated settings (#22992)	2 years ago
time.go	Remove unused setting `time.FORMAT` (#24430)	2 years ago
ui.go	Allow to set explore page default sort (#27951)	1 year ago
webhook.go	Refactor the setting to make unit test easier (#22405)	2 years ago