aboutsummaryrefslogtreecommitdiffstats
path: root/routers/web/auth
Commit message (Collapse)AuthorAgeFilesLines
* Fix error on account activation with wrong passwd (#22609)Otto Richter (fnetX)2023-01-281-3/+3
| | | | | | | | | | | | | | On activating local accounts, the error message didn't differentiate between using a wrong or expired token, or a wrong password. The result could already be obtained from the behaviour (different screens were presented), but the error message was misleading and lead to confusion for new users on Codeberg with Forgejo. Now, entering a wrong password for a valid token prints a different error message. The problem was introduced in 0f14f69e6070c9aca09f57c419e7d6007d0e520b. Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Allow setting `redirect_to` cookie on OAuth login (#22594)Sybren2023-01-241-0/+5
| | | | | | | | | | | | | | The regular login flow can use a `redirect_to` cookie to ensure the user ends their authentication flow on the same page as where they started it. This commit adds the same functionality to the OAuth login URLs, so that you can use URLs like these to directly use a specific OAuth provider: `/user/oauth2/{provider}?redirect_to={post-login path}` Only the `auth.SignInOAuth()` function needed a change for this, as the rest of the login flow is aware of this cookie and uses it properly already.
* Replace deprecated Webauthn library (#22400)techknowlogick2023-01-111-2/+2
| | | | | Fix #22052 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* refactor some functions to support ctx as first parameter (#21878)Lunny Xiao2022-12-034-8/+8
| | | | Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: Lauris BH <lauris@nix.lv>
* Implement FSFE REUSE for golang files (#21840)flynnnnnnnnnn2022-11-279-18/+9
| | | | | | | | | Change all license headers to comply with REUSE specification. Fix #16132 Co-authored-by: flynnnnnnnnnn <flynnnnnnnnnn@github> Co-authored-by: John Olheiser <john.olheiser@gmail.com>
* Add option to enable CAPTCHA validation for login (#21638)Xinyu Zhou2022-11-223-115/+25
| | | | | | | | | | | | | | | | | Enable this to require captcha validation for user login. You also must enable `ENABLE_CAPTCHA`. Summary: - Consolidate CAPTCHA template - add CAPTCHA handle and context - add `REQUIRE_CAPTCHA_FOR_LOGIN` config and docs - Consolidate CAPTCHA set-up and verification code Partially resolved #6049 Signed-off-by: Xinyu Zhou <i@sourcehut.net> Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Andrew Thornton <art27@cantab.net>
* Extract updateSession function to reduce repetition (#21735)Jason Song2022-11-104-135/+80
| | | | | | | A simple refactor to reduce duplicate codes. Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: delvh <dev.lh@web.de>
* Set last login when activating account (#21731)Jason Song2022-11-091-0/+7
| | | | | | | | Fix #21698. Set the last login time to the current time when activating the user successfully. Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Replace all instances of fmt.Errorf(%v) with fmt.Errorf(%w) (#21551)delvh2022-10-242-3/+3
| | | | | | | | | Found using `find . -type f -name '*.go' -print -exec vim {} -c ':%s/fmt\.Errorf(\(.*\)%v\(.*\)err/fmt.Errorf(\1%w\2err/g' -c ':wq' \;` Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Andrew Thornton <art27@cantab.net> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Record OAuth client type at registration (#21316)M Hickford2022-10-241-1/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The OAuth spec [defines two types of client](https://datatracker.ietf.org/doc/html/rfc6749#section-2.1), confidential and public. Previously Gitea assumed all clients to be confidential. > OAuth defines two client types, based on their ability to authenticate securely with the authorization server (i.e., ability to > maintain the confidentiality of their client credentials): > > confidential > Clients capable of maintaining the confidentiality of their credentials (e.g., client implemented on a secure server with > restricted access to the client credentials), or capable of secure client authentication using other means. > > **public > Clients incapable of maintaining the confidentiality of their credentials (e.g., clients executing on the device used by the resource owner, such as an installed native application or a web browser-based application), and incapable of secure client authentication via any other means.** > > The client type designation is based on the authorization server's definition of secure authentication and its acceptable exposure levels of client credentials. The authorization server SHOULD NOT make assumptions about the client type. https://datatracker.ietf.org/doc/html/rfc8252#section-8.4 > Authorization servers MUST record the client type in the client registration details in order to identify and process requests accordingly. Require PKCE for public clients: https://datatracker.ietf.org/doc/html/rfc8252#section-8.1 > Authorization servers SHOULD reject authorization requests from native apps that don't use PKCE by returning an error message Fixes #21299 Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Require authentication for OAuth token refresh (#21421)M Hickford2022-10-231-0/+29
| | | | | | | | | | | | | | According to the OAuth spec https://datatracker.ietf.org/doc/html/rfc6749#section-6 when "Refreshing an Access Token" > The authorization server MUST ... require client authentication for confidential clients Fixes #21418 Co-authored-by: Gusted <williamzijl7@hotmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Suppress `ExternalLoginUserNotExist` error (#21504)KN4CK3R2022-10-192-2/+8
| | | | | | | | Fixes #21202 Closes #21276 An `ExternalLoginUser` is not mandatory if the current user account was created with/by the external login source.
* Support instance-wide OAuth2 applications (#21335)qwerty2872022-10-121-5/+12
| | | | | | | Support OAuth2 applications created by admins on the admin panel, they aren't owned by anybody. Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Lauris BH <lauris@nix.lv>
* Parse OAuth Authorization header when request omits client secret (#21351)M Hickford2022-10-071-2/+21
| | | | | | | | | | | | | This fixes error "unauthorized_client: invalid client secret" when client includes secret in Authorization header rather than request body. OAuth spec permits both. Sanity validation that client id and client secret in request are consistent with Authorization header. Improve error descriptions. Error codes remain the same. Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: zeripath <art27@cantab.net>
* Improve error descriptions for unauthorized_client (#21292)M Hickford2022-09-281-4/+4
| | | | | | | | | | | | | | | Fixes #21282 As suggested by the [OAuth RFC](https://www.rfc-editor.org/rfc/rfc6749) (quoted below), it's helpful to give more detail in the description > error_description OPTIONAL. Human-readable ASCII [[USASCII](https://www.rfc-editor.org/rfc/rfc6749#ref-USASCII)] text providing **additional information, used to assist the client developer in understanding the error that occurred.** Values for the "error_description" parameter MUST NOT include characters outside the set %x20-21 / %x23-5B / %x5D-7E.
* Move some files into models' sub packages (#20262)Lunny Xiao2022-08-251-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | * Move some files into models' sub packages * Move functions * merge main branch * Fix check * fix check * Fix some tests * Fix lint * Fix lint * Revert lint changes * Fix error comments * Fix lint Co-authored-by: 6543 <6543@obermui.de>
* Refactor AssertExistsAndLoadBean to use generics (#20797)Lunny Xiao2022-08-161-1/+1
| | | | | | | * Refactor AssertExistsAndLoadBean to use generics * Fix tests Co-authored-by: zeripath <art27@cantab.net>
* Add support mCaptcha as captcha provider (#20458)Gusted2022-08-103-0/+27
| | | | | https://mcaptcha.org/ Co-authored-by: Felipe Leopoldo Sologuren Gutiérrez <fsologureng@users.noreply.github.com>
* WebAuthn CredentialID field needs to be increased in size (#20530)zeripath2022-07-301-2/+1
| | | | | | | | | | | | | WebAuthn have updated their specification to set the maximum size of the CredentialID to 1023 bytes. This is somewhat larger than our current size and therefore we need to migrate. The PR changes the struct to add CredentialIDBytes and migrates the CredentialID string to the bytes field before another migration drops the old CredentialID field. Another migration renames this field back. Fix #20457 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Remove U2F support (#20141)Gusted2022-06-262-14/+3
| | | | | | - Completely remove U2F support from 1.18.0, 1.17.0 will be the last release that U2F is somewhat supported. Users who used U2F would already be warned about using U2F for a while now and should hopefully already be migrated. But starting 1.18 definitely remove it.
* Make better use of i18n (#20096)Gusted2022-06-262-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Prototyping * Start work on creating offsets * Modify tests * Start prototyping with actual MPH * Twiddle around * Twiddle around comments * Convert templates * Fix external languages * Fix latest translation * Fix some test * Tidy up code * Use simple map * go mod tidy * Move back to data structure - Uses less memory by creating for each language a map. * Apply suggestions from code review Co-authored-by: delvh <dev.lh@web.de> * Add some comments * Fix tests * Try to fix tests * Use en-US as defacto fallback * Use correct slices * refactor (#4) * Remove TryTr, add log for missing translation key * Refactor i18n - Separate dev and production locale stores. - Allow for live-reloading in dev mode. Co-authored-by: zeripath <art27@cantab.net> * Fix live-reloading & check for errors * Make linter happy * live-reload with periodic check (#5) * Fix tests Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: zeripath <art27@cantab.net>
* Use neutral language in comments and docs (#20135)Gusted2022-06-251-1/+1
| | | - Replace `his/her` to `their`, as it's more neutral language.
* Catch the error before the response is processed by goth. (#20000)SteveTheEngineer2022-06-201-12/+20
| | | | | | | The code introduced by #18185 gets the error from response after it was processed by goth. That is incorrect, as goth (and golang.org/x/oauth) doesn't really care about the error, and it sends a token request with an empty authorization code to the server anyway, which always results in a `oauth2: cannot fetch token: 400 Bad Request` error from goth. It means that unless the "state" parameter is omitted from the error response (which is required to be present, according to [RFC 6749, Section 4.1.2.1](https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1)) or the page is reloaded (makes the session invalid), a 500 Internal Server Error page will be displayed. This fixes it by handling the error before the request is passed to goth.
* Add more linters to improve code readability (#19989)Wim2022-06-201-1/+1
| | | | | | | | | | Add nakedret, unconvert, wastedassign, stylecheck and nolintlint linters to improve code readability - nakedret - https://github.com/alexkohler/nakedret - nakedret is a Go static analysis tool to find naked returns in functions greater than a specified function length. - unconvert - https://github.com/mdempsky/unconvert - Remove unnecessary type conversions - wastedassign - https://github.com/sanposhiho/wastedassign - wastedassign finds wasted assignment statements. - notlintlint - Reports ill-formed or insufficient nolint directives - stylecheck - https://staticcheck.io/docs/checks/#ST - keep style consistent - excluded: [ST1003 - Poorly chosen identifier](https://staticcheck.io/docs/checks/#ST1003) and [ST1005 - Incorrectly formatted error string](https://staticcheck.io/docs/checks/#ST1005)
* Use DisplayName() instead of FullName in Oauth provider (#19991)oGi4i2022-06-162-1/+20
| | | | | Use DisplayName() in Oauth as this provides a fallback if FullName is not set. Closes #19382
* Adding button to link accounts from user settings (#19792)Mai-Lapyst2022-05-291-1/+11
| | | | | * Adding button to link accounts from user settings * Only display button to link user accounts when at least one OAuth2 provider is active
* Prevent NPE when cache service is disabled (#19703)zeripath2022-05-212-9/+15
| | | | | | | | | | | | | | The cache service can be disabled - at which point ctx.Cache will be nil and the use of it will cause an NPE. The main part of this PR is that the cache is used for restricting resending of activation mails and without this we cache we cannot restrict this. Whilst this code could be re-considered to use the db and probably should be, I think we can simply disable this code in the case that the cache is disabled. There are also several bug fixes in the /nodeinfo API endpoint. Signed-off-by: Andrew Thornton <art27@cantab.net>
* Move almost all functions' parameter db.Engine to context.Context (#19748)Lunny Xiao2022-05-205-27/+29
| | | | * Move almost all functions' parameter db.Engine to context.Context * remove some unnecessary wrap functions
* Federation: return useful statistic information for nodeinfo (#19561)65432022-05-021-1/+1
| | | Add statistic information for total user count, active user count, issue count and comment count for `/nodeinfo`
* Respect DefaultUserIsRestricted system default when creating new user (#19310)Jimmy Praet2022-04-294-26/+25
| | | | | | | | | | | | | | | | | | | * Apply DefaultUserIsRestricted in CreateUser * Enforce system defaults in CreateUser Allow for overwrites with CreateUserOverwriteOptions * Fix compilation errors * Add "restricted" option to create user command * Add "restricted" option to create user admin api * Respect default setting.Service.RegisterEmailConfirm and setting.Service.RegisterManualConfirm where needed * Revert "Respect default setting.Service.RegisterEmailConfirm and setting.Service.RegisterManualConfirm where needed" This reverts commit ee95d3e8dc9e9fff4fa66a5111e4d3930280e033.
* Use a struct as test options (#19393)Lunny Xiao2022-04-141-1/+3
| | | | | | | * Use a struct as test options * Fix name * Fix test
* Refactor CSRF protection modules, make sure CSRF tokens can be up-to-date. ↵wxiaoguang2022-04-082-2/+2
| | | | | | (#19337) Do a refactoring to the CSRF related code, remove most unnecessary functions. Parse the generated token's issue time, regenerate the token every a few minutes.
* Update HTTP status codes to modern codes (#18063)KN4CK3R2022-03-232-6/+6
| | | | | | * 2xx/3xx/4xx/5xx -> http.Status... * http.StatusFound -> http.StatusTemporaryRedirect * http.StatusMovedPermanently -> http.StatusPermanentRedirect
* Use `ctx` instead of `db.DefaultContext` in some ↵wxiaoguang2022-03-223-11/+9
| | | | | | | | | | | | packages(routers/services/modules) (#19163) * Remove `db.DefaultContext` usage in routers, use `ctx` directly * Use `ctx` directly if there is one, remove some `db.DefaultContext` in `services` * Use ctx instead of db.DefaultContext for `cmd` and some `modules` packages * fix incorrect context usage
* Renamed ctx.User to ctx.Doer. (#19161)KN4CK3R2022-03-223-20/+20
| | | | Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Do not send activation email if manual confirm is set (#19119)zeripath2022-03-181-0/+6
| | | | | | | | | | If the mailer is configured then even if Manual confirm is set an activation email is still being sent because `handleUserCreated` is not checking for this case. Fix #17263 Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Handle email address not exist. (#19089)KN4CK3R2022-03-151-1/+1
|
* Restrict email address validation (#17688)Lunny Xiao2022-03-141-0/+3
| | | This didn't follow the RFC but it's a subset of that. I think we should narrow the allowed chars at first and discuss more possibility in future PRs.
* Prevent panic on prohibited user login with oauth2 (#18562)zeripath2022-02-031-1/+1
| | | | | | | | | | | There was an unfortunate regression in #17962 where following detection of the UserProhibitLogin error the err is cast to a pointer by mistake. This causes a panic due to an interface error. Fix #18561 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Fix OAuth Source Edit Page (#18495)zeripath2022-01-311-0/+4
| | | | | | | | * Fix OAuth Source Edit Page to ensure restricted and group settings are set * Also tolerate []interface in the groups Fix #18432 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Use base32 for 2FA scratch token (#18384)wxiaoguang2022-01-261-1/+1
| | | | * Use base32 for 2FA scratch token * rename Secure* to Crypto*, add comments
* Refactor jwt.StandardClaims to RegisteredClaims (#18344)zeripath2022-01-201-14/+10
| | | | | | | | | | | | | | | * Refactor jwt.StandardClaims to RegisteredClaims go-jwt/jwt has deprecated the StandardClaims interface to use RegisteredClaims instead. This PR migrates to use this new format. Signed-off-by: Andrew Thornton <art27@cantab.net> * Apply suggestions from code review Co-authored-by: Gusted <williamzijl7@hotmail.com> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Gusted <williamzijl7@hotmail.com>
* format with gofumpt (#18184)65432022-01-205-11/+6
| | | | | | | | | | | * gofumpt -w -l . * gofumpt -w -l -extra . * Add linter * manual fix * change make fmt
* Enable deprecation error for v1.17.0 (#18341)Gusted2022-01-201-0/+1
| | | Co-authored-by: Andrew Thornton <art27@cantab.net>
* Fix incorrect OAuth message (#18332)wxiaoguang2022-01-191-1/+1
| | | | | As the title, Fix #18327
* Webauthn nits (#18284)zeripath2022-01-151-2/+2
| | | | | | | This contains some additional fixes and small nits related to #17957 Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Support webauthn (#17957)Lunny Xiao2022-01-146-155/+192
| | | | | | | Migrate from U2F to Webauthn Co-authored-by: Andrew Thornton <art27@cantab.net> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Show OAuth callback error message (#18185)KN4CK3R2022-01-071-1/+35
| | | | | | | | | | | * Show callback error message. * lint * Use error code to display a message. Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Refactor auth package (#17962)Lunny Xiao2022-01-029-0/+3416
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-17 13:57:10 +0000