diff options
| author | Giteabot <teabot@gitea.io> | 2023-12-12 13:45:00 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-12-12 13:45:00 +0800 |
| commit | f144521aea0d7a08b9bd5f17e49bae4021bd7a45 (patch) | |
| tree | 0e146c2c9cb769ff9ff593e6846f9954b295e732 /templates | |
| parent | 6f4d5c0b8c924660d29f8fe2ca2b92b1848981bd (diff) | |
| download | gitea-f144521aea0d7a08b9bd5f17e49bae4021bd7a45.tar.gz gitea-f144521aea0d7a08b9bd5f17e49bae4021bd7a45.zip | |
Deprecate query string auth tokens (#28390) (#28430)
Backport #28390 by @jackHay22
## Changes
- Add deprecation warning to `Token` and `AccessToken` authentication
methods in swagger.
- Add deprecation warning header to API response. Example:
```
HTTP/1.1 200 OK
...
Warning: token and access_token API authentication is deprecated
...
```
- Add setting `DISABLE_QUERY_AUTH_TOKEN` to reject query string auth
tokens entirely. Default is `false`
## Next steps
- `DISABLE_QUERY_AUTH_TOKEN` should be true in a subsequent release and
the methods should be removed in swagger
- `DISABLE_QUERY_AUTH_TOKEN` should be removed and the implementation of
the auth methods in question should be removed
## Open questions
- Should there be further changes to the swagger documentation?
Deprecation is not yet supported for security definitions (coming in
[OpenAPI Spec version
3.2.0](https://github.com/OAI/OpenAPI-Specification/issues/2506))
- Should the API router logger sanitize urls that use `token` or
`access_token`? (This is obviously an insufficient solution on its own)
Co-authored-by: Jack Hay <jack@allspice.io>
Co-authored-by: delvh <dev.lh@web.de>
Diffstat (limited to 'templates')
| -rw-r--r-- | templates/swagger/v1_json.tmpl | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/templates/swagger/v1_json.tmpl b/templates/swagger/v1_json.tmpl index 2a726a77c6..73f86bf8a6 100644 --- a/templates/swagger/v1_json.tmpl +++ b/templates/swagger/v1_json.tmpl @@ -23955,6 +23955,7 @@ }, "securityDefinitions": { "AccessToken": { + "description": "This authentication option is deprecated for removal in Gitea 1.23. Please use AuthorizationHeaderToken instead.", "type": "apiKey", "name": "access_token", "in": "query" @@ -23987,6 +23988,7 @@ "in": "header" }, "Token": { + "description": "This authentication option is deprecated for removal in Gitea 1.23. Please use AuthorizationHeaderToken instead.", "type": "apiKey", "name": "token", "in": "query" |