diff options
author | Giteabot <teabot@gitea.io> | 2023-12-12 13:45:00 +0800 |
---|---|---|
committer | GitHub <noreply@github.com> | 2023-12-12 13:45:00 +0800 |
commit | f144521aea0d7a08b9bd5f17e49bae4021bd7a45 (patch) | |
tree | 0e146c2c9cb769ff9ff593e6846f9954b295e732 /modules/structs/commit_status_test.go | |
parent | 6f4d5c0b8c924660d29f8fe2ca2b92b1848981bd (diff) | |
download | gitea-f144521aea0d7a08b9bd5f17e49bae4021bd7a45.tar.gz gitea-f144521aea0d7a08b9bd5f17e49bae4021bd7a45.zip |
Deprecate query string auth tokens (#28390) (#28430)
Backport #28390 by @jackHay22
## Changes
- Add deprecation warning to `Token` and `AccessToken` authentication
methods in swagger.
- Add deprecation warning header to API response. Example:
```
HTTP/1.1 200 OK
...
Warning: token and access_token API authentication is deprecated
...
```
- Add setting `DISABLE_QUERY_AUTH_TOKEN` to reject query string auth
tokens entirely. Default is `false`
## Next steps
- `DISABLE_QUERY_AUTH_TOKEN` should be true in a subsequent release and
the methods should be removed in swagger
- `DISABLE_QUERY_AUTH_TOKEN` should be removed and the implementation of
the auth methods in question should be removed
## Open questions
- Should there be further changes to the swagger documentation?
Deprecation is not yet supported for security definitions (coming in
[OpenAPI Spec version
3.2.0](https://github.com/OAI/OpenAPI-Specification/issues/2506))
- Should the API router logger sanitize urls that use `token` or
`access_token`? (This is obviously an insufficient solution on its own)
Co-authored-by: Jack Hay <jack@allspice.io>
Co-authored-by: delvh <dev.lh@web.de>
Diffstat (limited to 'modules/structs/commit_status_test.go')
0 files changed, 0 insertions, 0 deletions