aboutsummaryrefslogtreecommitdiffstats
path: root/routers/web/auth/auth.go
Commit message (Collapse)AuthorAgeFilesLines
* enable staticcheck QFxxxx rules (#34064)TheFox0x711 days1-2/+3
|
* Refactor error system (#33610)wxiaoguang2025-02-161-3/+3
|
* Support disable passkey auth (#33348)yp053272025-01-221-0/+1
| | | | | | | Fix #33314 --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Support for email addresses containing uppercase characters when activating ↵Zettat1232024-12-271-2/+2
| | | | | | | | | user account (#32998) Fix #32807 --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Refactor template & test related code (#32938)wxiaoguang2024-12-221-7/+7
| | | Move some legacy code from "base" package to proper packages.
* Allow to disable the password-based login (sign-in) form (#32687)wxiaoguang2024-12-021-31/+17
| | | | | | | | | | | | | | Usually enterprise/organization users would like to only allow OAuth2 login. This PR adds a new config option to disable the password-based login form. It is a simple and clear approach and won't block the future login-system refactoring works. Fix a TODO in #24821 Replace #21851 Close #7633 , close #13606
* Refactor CSRF token (#32216)wxiaoguang2024-10-101-3/+5
|
* Failed authentications are logged to level Warning (#32016)Daniel2024-09-111-4/+4
| | | | | | | PR for issue #31968 Replaces PR #31983 to comply with gitea's error definition Failed authentications are now logged to level `Warning` instead of `Info`.
* Save initial signup information for users to aid in spam prevention (#31852)techknowlogick2024-09-091-1/+5
| | | | | | | | | | | | | | This will allow instance admins to view signup pattern patterns for public instances. It is modelled after discourse, mastodon, and MediaWiki's approaches. Note: This has privacy implications, but as the above-stated open-source projects take this approach, especially MediaWiki, which I have no doubt looked into this thoroughly, it is likely okay for us, too. However, I would be appreciative of any feedback on how this could be improved. --------- Co-authored-by: Giteabot <teabot@gitea.io>
* Remove urls from translations (#31950)Denys Konovalov2024-09-021-1/+1
| | | | | | | Part of #27700 Removes all URLs from translation strings to easy up changing them in the future and to exclude people injecting malicious URLs through translations. First measure as long as #24402 is out of scope.
* allow synchronizing user status from OAuth2 login providers (#31572)Rowan Bohde2024-07-161-4/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This leverages the existing `sync_external_users` cron job to synchronize the `IsActive` flag on users who use an OAuth2 provider set to synchronize. This synchronization is done by checking for expired access tokens, and using the stored refresh token to request a new access token. If the response back from the OAuth2 provider is the `invalid_grant` error code, the user is marked as inactive. However, the user is able to reactivate their account by logging in the web browser through their OAuth2 flow. Also changed to support this is that a linked `ExternalLoginUser` is always created upon a login or signup via OAuth2. ### Notes on updating permissions Ideally, we would also refresh permissions from the configured OAuth provider (e.g., admin, restricted and group mappings) to match the implementation of LDAP. However, the OAuth library used for this `goth`, doesn't seem to support issuing a session via refresh tokens. The interface provides a [`RefreshToken` method](https://github.com/markbates/goth/blob/master/provider.go#L20), but the returned `oauth.Token` doesn't implement the `goth.Session` we would need to call `FetchUser`. Due to specific implementations, we would need to build a compatibility function for every provider, since they cast to concrete types (e.g. [Azure](https://github.com/markbates/goth/blob/master/providers/azureadv2/azureadv2.go#L132)) --------- Co-authored-by: Kyle D <kdumontnu@gmail.com>
* Add missed return after `ctx.ServerError` (#31130)Lunny Xiao2024-05-281-0/+1
|
* Refactor AppURL usage (#30885)wxiaoguang2024-05-071-1/+1
| | | | | | | | Fix #30883 Fix #29591 --------- Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Improve oauth2 client "preferred username field" logic and the error ↵wxiaoguang2024-04-251-7/+7
| | | | | | | | | | | | | handling (#30622) Follow #30454 And fix #24957 When using "preferred_username", if no such field, `extractUserNameFromOAuth2` (old `getUserName`) shouldn't return an error. All other USERNAME options do not return such error. And fine tune some logic and error messages, make code more stable and more friendly to end users.
* Allow `preferred_username` as username source for OIDC (#30454)SimonErm2024-04-161-0/+7
| | | | | | This PR adds the preferred_username claim as a possible username source for the oauth2_client. Closes #21518
* Refactor external URL detection (#29973)wxiaoguang2024-03-221-2/+2
| | | | Follow #29960, `IsExternalURL` is not needed anymore. Add some tests for `RedirectToCurrentSite`
* Refactor URL detection (#29960)wxiaoguang2024-03-211-3/+3
| | | "Redirect" functions should only redirect if the target is for current Gitea site.
* Make "/user/login" page redirect if the current user has signed in (#29583)wxiaoguang2024-03-051-10/+20
| | | | Fix #29582 and maybe more. Maybe fix #29116
* remove util.OptionalBool and related functions (#29513)65432024-03-021-4/+4
| | | | | | and migrate affected code _last refactoring bits to replace **util.OptionalBool** with **optional.Option[bool]**_
* Allow to change primary email before account activation (#29412)wxiaoguang2024-02-271-3/+28
|
* Move context from modules to services (#29440)Lunny Xiao2024-02-271-1/+1
| | | | | | | | | | | | | | | Since `modules/context` has to depend on `models` and many other packages, it should be moved from `modules/context` to `services/context` according to design principles. There is no logic code change on this PR, only move packages. - Move `code.gitea.io/gitea/modules/context` to `code.gitea.io/gitea/services/context` - Move `code.gitea.io/gitea/modules/contexttest` to `code.gitea.io/gitea/services/contexttest` because of depending on context - Move `code.gitea.io/gitea/modules/upload` to `code.gitea.io/gitea/services/context/upload` because of depending on context
* Refactor "user/active" related logic (#29390)wxiaoguang2024-02-251-59/+66
| | | | | And add more tests. Remove a lot of fragile "if" blocks. The old logic is kept as-is.
* Revert "Support SAML authentication (#25165)" (#29358)65432024-02-241-26/+9
| | | | | | | | | | This reverts #25165 (5bb8d1924d77c675467694de26697b876d709a17), as there was a chance some important reviews got missed. so after reverting this patch it will be resubmitted for reviewing again https://github.com/go-gitea/gitea/pull/25165#issuecomment-1960670242 temporary Open #5512 again
* Support SAML authentication (#25165)techknowlogick2024-02-231-9/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Closes https://github.com/go-gitea/gitea/issues/5512 This PR adds basic SAML support - Adds SAML 2.0 as an auth source - Adds SAML configuration documentation - Adds integration test: - Use bare-bones SAML IdP to test protocol flow and test account is linked successfully (only runs on Postgres by default) - Adds documentation for configuring and running SAML integration test locally Future PRs: - Support group mapping - Support auto-registration (account linking) Co-Authored-By: @jackHay22 --------- Co-authored-by: jackHay22 <jack@allspice.io> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Jason Song <i@wolfogre.com> Co-authored-by: morphelinho <morphelinho@users.noreply.github.com> Co-authored-by: Zettat123 <zettat123@gmail.com> Co-authored-by: Yarden Shoham <git@yardenshoham.com> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: silverwind <me@silverwind.io>
* Unify user update methods (#28733)KN4CK3R2024-02-041-21/+25
| | | | | | | | | | | Fixes #28660 Fixes an admin api bug related to `user.LoginSource` Fixed `/user/emails` response not identical to GitHub api This PR unifies the user update methods. The goal is to keep the logic only at one place (having audit logs in mind). For example, do the password checks only in one method not everywhere a password is updated. After that PR is merged, the user creation should be next.
* Normalize oauth email username (#28561)Kyle D2024-01-031-4/+4
|
* Avoid cycle-redirecting user/login page (#28636)wxiaoguang2023-12-301-5/+5
| | | | Fix #28231, and remove some unused code. The `db.HasEngine` doesn't seem useful because the db engine is always initialized before web route.
* Always enable caches (#28527)Lunny Xiao2023-12-191-10/+6
| | | | | | | | | Nowadays, cache will be used on almost everywhere of Gitea and it cannot be disabled, otherwise some features will become unaviable. Then I think we can just remove the option for cache enable. That means cache cannot be disabled. But of course, we can still use cache configuration to set how should Gitea use the cache.
* Refactor Find Sources and fix bug when view a user who belongs to an ↵Lunny Xiao2023-11-031-8/+4
| | | | | | | | | | | | unactive auth source (#27798) The steps to reproduce it. First, create a new oauth2 source. Then, a user login with this oauth2 source. Disable the oauth2 source. Visit users -> settings -> security, 500 will be displayed. This is because this page only load active Oauth2 sources but not all Oauth2 sources.
* Final round of `db.DefaultContext` refactor (#27587)JakobDev2023-10-141-5/+5
| | | Last part of #27065
* Enhanced auth token / remember me (#27606)KN4CK3R2023-10-141-24/+40
| | | | | | | | | | | | | | | | | Closes #27455 > The mechanism responsible for long-term authentication (the 'remember me' cookie) uses a weak construction technique. It will hash the user's hashed password and the rands value; it will then call the secure cookie code, which will encrypt the user's name with the computed hash. If one were able to dump the database, they could extract those two values to rebuild that cookie and impersonate a user. That vulnerability exists from the date the dump was obtained until a user changed their password. > > To fix this security issue, the cookie could be created and verified using a different technique such as the one explained at https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies. The PR removes the now obsolete setting `COOKIE_USERNAME`.
* Penultimate round of `db.DefaultContext` refactor (#27414)JakobDev2023-10-111-2/+2
| | | | | | | Part of #27065 --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Next round of `db.DefaultContext` refactor (#27089)JakobDev2023-09-161-1/+1
| | | Part of #27065
* More refactoring of `db.DefaultContext` (#27083)JakobDev2023-09-151-1/+1
| | | Next step of #27065
* Reduce usage of `db.DefaultContext` (#27073)JakobDev2023-09-141-10/+10
| | | | | | | | | | | | | | Part of #27065 This reduces the usage of `db.DefaultContext`. I think I've got enough files for the first PR. When this is merged, I will continue working on this. Considering how many files this PR affect, I hope it won't take to long to merge, so I don't end up in the merge conflict hell. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Show OpenID Connect and OAuth on signup page (#20242)Dmitry Sharshakov2023-09-131-0/+18
| | | | | | | | Fix #19809 --------- Signed-off-by: Dmitry Sharshakov <d3dx12.xx@gmail.com> Co-authored-by: jackHay22 <jack@allspice.io>
* Update team invitation email link (#26550)Jack Hay2023-08-311-0/+11
| | | | | Co-authored-by: Kyle D <kdumontnu@gmail.com> Co-authored-by: Jonathan Tran <jonnytran@gmail.com>
* Less naked returns (#25713)65432023-07-071-8/+8
| | | | | just a step towards #25655 and some related refactoring
* Replace `interface{}` with `any` (#25686)silverwind2023-07-041-7/+7
| | | | | Result of running `perl -p -i -e 's#interface\{\}#any#g' **/*` and `make fmt`. Basically the same [as golang did](https://github.com/golang/go/commit/2580d0e08d5e9f979b943758d3c49877fb2324cb).
* Log the real reason when authentication fails (but don't show the user) (#25414)Lunny Xiao2023-07-031-1/+1
|
* Use JSON response for "user/logout" (#25522)wxiaoguang2023-06-261-1/+1
| | | | The request sent to "user/logout" is from "link-action", it expects to get JSON response.
* Split "modules/context.go" to separate files (#24569)wxiaoguang2023-05-081-1/+1
| | | | | | | | | | | | | | The "modules/context.go" is too large to maintain. This PR splits it to separate files, eg: context_request.go, context_response.go, context_serve.go This PR will help: 1. The future refactoring for Gitea's web context (eg: simplify the context) 2. Introduce proper "range request" support 3. Introduce context function This PR only moves code, doesn't change any logic.
* Refactor cookie (#24107)wxiaoguang2023-04-131-12/+11
| | | | | | | | | | | | Close #24062 At the beginning, I just wanted to fix the warning mentioned by #24062 But, the cookie code really doesn't look good to me, so clean up them. Complete the TODO on `SetCookie`: > TODO: Copied from gitea.com/macaron/macaron and should be improved after macaron removed.
* Provide the ability to set password hash algorithm parameters (#22942)zeripath2023-02-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | This PR refactors and improves the password hashing code within gitea and makes it possible for server administrators to set the password hashing parameters In addition it takes the opportunity to adjust the settings for `pbkdf2` in order to make the hashing a little stronger. The majority of this work was inspired by PR #14751 and I would like to thank @boppy for their work on this. Thanks to @gusted for the suggestion to adjust the `pbkdf2` hashing parameters. Close #14751 --------- Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: John Olheiser <john.olheiser@gmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Fix error on account activation with wrong passwd (#22609)Otto Richter (fnetX)2023-01-281-3/+3
| | | | | | | | | | | | | | On activating local accounts, the error message didn't differentiate between using a wrong or expired token, or a wrong password. The result could already be obtained from the behaviour (different screens were presented), but the error message was misleading and lead to confusion for new users on Codeberg with Forgejo. Now, entering a wrong password for a valid token prints a different error message. The problem was introduced in 0f14f69e6070c9aca09f57c419e7d6007d0e520b. Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* refactor some functions to support ctx as first parameter (#21878)Lunny Xiao2022-12-031-1/+1
| | | | Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: Lauris BH <lauris@nix.lv>
* Implement FSFE REUSE for golang files (#21840)flynnnnnnnnnn2022-11-271-2/+1
| | | | | | | | | Change all license headers to comply with REUSE specification. Fix #16132 Co-authored-by: flynnnnnnnnnn <flynnnnnnnnnn@github> Co-authored-by: John Olheiser <john.olheiser@gmail.com>
* Add option to enable CAPTCHA validation for login (#21638)Xinyu Zhou2022-11-221-44/+19
| | | | | | | | | | | | | | | | | Enable this to require captcha validation for user login. You also must enable `ENABLE_CAPTCHA`. Summary: - Consolidate CAPTCHA template - add CAPTCHA handle and context - add `REQUIRE_CAPTCHA_FOR_LOGIN` config and docs - Consolidate CAPTCHA set-up and verification code Partially resolved #6049 Signed-off-by: Xinyu Zhou <i@sourcehut.net> Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Andrew Thornton <art27@cantab.net>
* Extract updateSession function to reduce repetition (#21735)Jason Song2022-11-101-65/+52
| | | | | | | A simple refactor to reduce duplicate codes. Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: delvh <dev.lh@web.de>
* Set last login when activating account (#21731)Jason Song2022-11-091-0/+7
| | | | | | | | Fix #21698. Set the last login time to the current time when activating the user successfully. Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-09 14:42:56 +0000