summaryrefslogtreecommitdiffstats
path: root/custom/conf
diff options
context:
space:
mode:
authorLunny Xiao <xiaolunwen@gmail.com>2023-09-07 16:31:46 +0800
committerGitHub <noreply@github.com>2023-09-07 08:31:46 +0000
commite97e883ad50774f249c8c694598c25a17227299b (patch)
treead48381f40d2be7cb14265625f2fe7138f509537 /custom/conf
parent1221221595122c212ace8bc50f2904bead8d2655 (diff)
downloadgitea-e97e883ad50774f249c8c694598c25a17227299b.tar.gz
gitea-e97e883ad50774f249c8c694598c25a17227299b.zip
Add reverseproxy auth for API back with default disabled (#26703)
This feature was removed by #22219 to avoid possible CSRF attack. This PR takes reverseproxy auth for API back but with default disabled. To prevent possbile CSRF attack, the responsibility will be the reverseproxy but not Gitea itself. For those want to enable this `ENABLE_REVERSE_PROXY_AUTHENTICATION_API`, they should know what they are doing. --------- Co-authored-by: Giteabot <teabot@gitea.io>
Diffstat (limited to 'custom/conf')
-rw-r--r--custom/conf/app.example.ini2
1 files changed, 2 insertions, 0 deletions
diff --git a/custom/conf/app.example.ini b/custom/conf/app.example.ini
index a2fab2fd50..fbaea9dc27 100644
--- a/custom/conf/app.example.ini
+++ b/custom/conf/app.example.ini
@@ -759,6 +759,8 @@ LEVEL = Info
;;
;; More detail: https://github.com/gogits/gogs/issues/165
;ENABLE_REVERSE_PROXY_AUTHENTICATION = false
+; Enable this to allow reverse proxy authentication for API requests, the reverse proxy is responsible for ensuring that no CSRF is possible.
+;ENABLE_REVERSE_PROXY_AUTHENTICATION_API = false
;ENABLE_REVERSE_PROXY_AUTO_REGISTRATION = false
;ENABLE_REVERSE_PROXY_EMAIL = false
;ENABLE_REVERSE_PROXY_FULL_NAME = false