diff options
| author | wxiaoguang <wxiaoguang@gmail.com> | 2023-11-23 21:19:26 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-11-23 21:19:26 +0800 |
| commit | 7c0ab8b9741c0f63fc22be49a1026da52f4375a0 (patch) | |
| tree | 3e95f426fdc219b2a7f2c490fe32b70b30db14b8 /routers/web | |
| parent | 778d6043464d60e06af183ae24d764bf3e9fce0f (diff) | |
| download | gitea-7c0ab8b9741c0f63fc22be49a1026da52f4375a0.tar.gz gitea-7c0ab8b9741c0f63fc22be49a1026da52f4375a0.zip | |
Make CORS work for oauth2 handlers (#28184)
Fix #25473
Although there was `m.Post("/login/oauth/access_token", CorsHandler()...`,
it never really worked, because it still lacks the "OPTIONS" handler.
Diffstat (limited to 'routers/web')
| -rw-r--r-- | routers/web/misc/misc.go | 4 | ||||
| -rw-r--r-- | routers/web/web.go | 2 |
2 files changed, 6 insertions, 0 deletions
diff --git a/routers/web/misc/misc.go b/routers/web/misc/misc.go index 54c93763f6..e351994010 100644 --- a/routers/web/misc/misc.go +++ b/routers/web/misc/misc.go @@ -33,6 +33,10 @@ func DummyOK(w http.ResponseWriter, req *http.Request) { w.WriteHeader(http.StatusOK) } +func DummyBadRequest(w http.ResponseWriter, req *http.Request) { + w.WriteHeader(http.StatusBadRequest) +} + func RobotsTxt(w http.ResponseWriter, req *http.Request) { robotsTxt := util.FilePathJoinAbs(setting.CustomPath, "public/robots.txt") if ok, _ := util.IsExist(robotsTxt); !ok { diff --git a/routers/web/web.go b/routers/web/web.go index f8b745fb10..da7360f1b8 100644 --- a/routers/web/web.go +++ b/routers/web/web.go @@ -533,8 +533,10 @@ func registerRoutes(m *web.Route) { m.Post("/authorize", web.Bind(forms.AuthorizationForm{}), auth.AuthorizeOAuth) }, ignSignInAndCsrf, reqSignIn) m.Get("/login/oauth/userinfo", ignSignInAndCsrf, auth.InfoOAuth) + m.Options("/login/oauth/access_token", CorsHandler(), misc.DummyBadRequest) m.Post("/login/oauth/access_token", CorsHandler(), web.Bind(forms.AccessTokenForm{}), ignSignInAndCsrf, auth.AccessTokenOAuth) m.Get("/login/oauth/keys", ignSignInAndCsrf, auth.OIDCKeys) + m.Options("/login/oauth/introspect", CorsHandler(), misc.DummyBadRequest) m.Post("/login/oauth/introspect", CorsHandler(), web.Bind(forms.IntrospectTokenForm{}), ignSignInAndCsrf, auth.IntrospectOAuth) m.Group("/user/settings", func() { |