summaryrefslogtreecommitdiffstats
path: root/routers/web/auth
Commit message (Collapse)AuthorAgeFilesLines
* add CfTurnstileSitekey context data to all captcha templates (#31874) (#31876)Giteabot2024-08-202-0/+4
| | | | | | | | | | | | Backport #31874 by @bohde In the OpenID flows, the "CfTurnstileSitekey" wasn't populated, which caused those flows to fail if using Turnstile as the Captcha implementation. This adds the missing context variables, allowing Turnstile to be used in the OpenID flows. Co-authored-by: Rowan Bohde <rowan.bohde@gmail.com>
* Add missed return after `ctx.ServerError` (#31130) (#31133)Giteabot2024-05-281-0/+1
| | | | | Backport #31130 by @lunny Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* use existing oauth grant for public client (#31015) (#31042)Giteabot2024-05-211-2/+17
| | | | | | | | | | | Backport #31015 by @denyskon Do not try to create a new authorization grant when one exists already, thus preventing a DB-related authorization issue. Fix https://github.com/go-gitea/gitea/pull/30790#issuecomment-2118812426 Co-authored-by: Denys Konovalov <kontakt@denyskon.de> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Return `access_denied` error when an OAuth2 request is denied (#30974) (#31029)Giteabot2024-05-201-0/+10
| | | | | | Backport #30974 by Zettat123 Co-authored-by: Zettat123 <zettat123@gmail.com> Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Refactor AppURL usage (#30885) (#30891)wxiaoguang2024-05-081-1/+1
| | | | | | | Backport #30885 Fix #30883 Fix #29591 Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Prevent automatic OAuth grants for public clients (#30790) (#30836)Giteabot2024-05-021-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Backport #30790 by archer-321 This commit forces the resource owner (user) to always approve OAuth 2.0 authorization requests if the client is public (e.g. native applications). As detailed in [RFC 6749 Section 10.2](https://www.rfc-editor.org/rfc/rfc6749.html#section-10.2), > The authorization server SHOULD NOT process repeated authorization requests automatically (without active resource owner interaction) without authenticating the client or relying on other measures to ensure that the repeated request comes from the original client and not an impersonator. With the implementation prior to this patch, attackers with access to the redirect URI (e.g., the loopback interface for `git-credential-oauth`) can get access to the user account without any user interaction if they can redirect the user to the `/login/oauth/authorize` endpoint somehow (e.g., with `xdg-open` on Linux). Fixes #25061. Co-authored-by: Archer <archer@beezig.eu> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Improve oauth2 client "preferred username field" logic and the error ↵wxiaoguang2024-04-254-28/+81
| | | | | | | | | | | | | handling (#30622) Follow #30454 And fix #24957 When using "preferred_username", if no such field, `extractUserNameFromOAuth2` (old `getUserName`) shouldn't return an error. All other USERNAME options do not return such error. And fine tune some logic and error messages, make code more stable and more friendly to end users.
* Allow `preferred_username` as username source for OIDC (#30454)SimonErm2024-04-161-0/+7
| | | | | | This PR adds the preferred_username claim as a possible username source for the oauth2_client. Closes #21518
* Clean up log messages (#30313)wxiaoguang2024-04-071-2/+0
| | | | | | `log.Xxx("%v")` is not ideal, this PR adds necessary context messages. Remove some unnecessary logs. Co-authored-by: Giteabot <teabot@gitea.io>
* Refactor external URL detection (#29973)wxiaoguang2024-03-222-4/+3
| | | | Follow #29960, `IsExternalURL` is not needed anymore. Add some tests for `RedirectToCurrentSite`
* Refactor URL detection (#29960)wxiaoguang2024-03-213-5/+5
| | | "Redirect" functions should only redirect if the target is for current Gitea site.
* Make "/user/login" page redirect if the current user has signed in (#29583)wxiaoguang2024-03-052-10/+63
| | | | Fix #29582 and maybe more. Maybe fix #29116
* remove util.OptionalBool and related functions (#29513)65432024-03-021-4/+4
| | | | | | and migrate affected code _last refactoring bits to replace **util.OptionalBool** with **optional.Option[bool]**_
* Allow to change primary email before account activation (#29412)wxiaoguang2024-02-271-3/+28
|
* Move context from modules to services (#29440)Lunny Xiao2024-02-277-7/+7
| | | | | | | | | | | | | | | Since `modules/context` has to depend on `models` and many other packages, it should be moved from `modules/context` to `services/context` according to design principles. There is no logic code change on this PR, only move packages. - Move `code.gitea.io/gitea/modules/context` to `code.gitea.io/gitea/services/context` - Move `code.gitea.io/gitea/modules/contexttest` to `code.gitea.io/gitea/services/contexttest` because of depending on context - Move `code.gitea.io/gitea/modules/upload` to `code.gitea.io/gitea/services/context/upload` because of depending on context
* Refactor "user/active" related logic (#29390)wxiaoguang2024-02-251-59/+66
| | | | | And add more tests. Remove a lot of fragile "if" blocks. The old logic is kept as-is.
* Revert "Support SAML authentication (#25165)" (#29358)65432024-02-245-237/+39
| | | | | | | | | | This reverts #25165 (5bb8d1924d77c675467694de26697b876d709a17), as there was a chance some important reviews got missed. so after reverting this patch it will be resubmitted for reviewing again https://github.com/go-gitea/gitea/pull/25165#issuecomment-1960670242 temporary Open #5512 again
* Start to migrate from `util.OptionalBool` to `optional.Option[bool]` (#29329)65432024-02-231-1/+1
| | | just create transition helper and migrate two structs
* Support SAML authentication (#25165)techknowlogick2024-02-235-39/+237
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Closes https://github.com/go-gitea/gitea/issues/5512 This PR adds basic SAML support - Adds SAML 2.0 as an auth source - Adds SAML configuration documentation - Adds integration test: - Use bare-bones SAML IdP to test protocol flow and test account is linked successfully (only runs on Postgres by default) - Adds documentation for configuring and running SAML integration test locally Future PRs: - Support group mapping - Support auto-registration (account linking) Co-Authored-By: @jackHay22 --------- Co-authored-by: jackHay22 <jack@allspice.io> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Jason Song <i@wolfogre.com> Co-authored-by: morphelinho <morphelinho@users.noreply.github.com> Co-authored-by: Zettat123 <zettat123@gmail.com> Co-authored-by: Yarden Shoham <git@yardenshoham.com> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: silverwind <me@silverwind.io>
* Remove unnecessary "Str2html" modifier from templates (#29319)wxiaoguang2024-02-221-3/+4
| | | Follow #29165
* Do not use `ctx.Doer` when reset password (#29289)Jason Song2024-02-211-1/+1
| | | | | Fix #29278. Caused by a small typo in #28733
* Refactor more code in templates (#29236)wxiaoguang2024-02-181-9/+1
| | | | | | | | Follow #29165. * Introduce JSONTemplate to help to render JSON templates * Introduce JSEscapeSafe for templates. Now only use `{{ ... | JSEscape}}` instead of `{{ ... | JSEscape | Safe}}` * Simplify "UserLocationMapURL" useage
* Refactor locale&string&template related code (#29165)wxiaoguang2024-02-141-1/+1
| | | | | | Clarify when "string" should be used (and be escaped), and when "template.HTML" should be used (no need to escape) And help PRs like #29059 , to render the error messages correctly.
* Unify user update methods (#28733)KN4CK3R2024-02-043-113/+90
| | | | | | | | | | | Fixes #28660 Fixes an admin api bug related to `user.LoginSource` Fixed `/user/emails` response not identical to GitHub api This PR unifies the user update methods. The goal is to keep the logic only at one place (having audit logs in mind). For example, do the password checks only in one method not everywhere a password is updated. After that PR is merged, the user creation should be next.
* Normalize oauth email username (#28561)Kyle D2024-01-033-6/+15
|
* Avoid cycle-redirecting user/login page (#28636)wxiaoguang2023-12-301-5/+5
| | | | Fix #28231, and remove some unused code. The `db.HasEngine` doesn't seem useful because the db engine is always initialized before web route.
* Always enable caches (#28527)Lunny Xiao2023-12-192-15/+9
| | | | | | | | | Nowadays, cache will be used on almost everywhere of Gitea and it cannot be disabled, otherwise some features will become unaviable. Then I think we can just remove the option for cache enable. That means cache cannot be disabled. But of course, we can still use cache configuration to set how should Gitea use the cache.
* Refactor Find Sources and fix bug when view a user who belongs to an ↵Lunny Xiao2023-11-031-8/+4
| | | | | | | | | | | | unactive auth source (#27798) The steps to reproduce it. First, create a new oauth2 source. Then, a user login with this oauth2 source. Disable the oauth2 source. Visit users -> settings -> security, 500 will be displayed. This is because this page only load active Oauth2 sources but not all Oauth2 sources.
* Final round of `db.DefaultContext` refactor (#27587)JakobDev2023-10-143-11/+11
| | | Last part of #27065
* Enhanced auth token / remember me (#27606)KN4CK3R2023-10-144-48/+44
| | | | | | | | | | | | | | | | | Closes #27455 > The mechanism responsible for long-term authentication (the 'remember me' cookie) uses a weak construction technique. It will hash the user's hashed password and the rands value; it will then call the secure cookie code, which will encrypt the user's name with the computed hash. If one were able to dump the database, they could extract those two values to rebuild that cookie and impersonate a user. That vulnerability exists from the date the dump was obtained until a user changed their password. > > To fix this security issue, the cookie could be created and verified using a different technique such as the one explained at https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies. The PR removes the now obsolete setting `COOKIE_USERNAME`.
* Don't show Link to TOTP if not set up (#27585)JakobDev2023-10-111-0/+8
|
* Penultimate round of `db.DefaultContext` refactor (#27414)JakobDev2023-10-113-6/+6
| | | | | | | Part of #27065 --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Even more `db.DefaultContext` refactor (#27352)JakobDev2023-10-031-2/+2
| | | | | | | | Part of #27065 --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: delvh <dev.lh@web.de>
* make writing main test easier (#27270)Lunny Xiao2023-09-281-4/+1
| | | | | | | | | This PR removed `unittest.MainTest` the second parameter `TestOptions.GiteaRoot`. Now it detects the root directory by current working directory. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Another round of `db.DefaultContext` refactor (#27103)JakobDev2023-09-254-4/+4
| | | | | | | Part of #27065 --------- Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Next round of `db.DefaultContext` refactor (#27089)JakobDev2023-09-164-10/+10
| | | Part of #27065
* More refactoring of `db.DefaultContext` (#27083)JakobDev2023-09-155-10/+10
| | | Next step of #27065
* Reduce usage of `db.DefaultContext` (#27073)JakobDev2023-09-145-18/+18
| | | | | | | | | | | | | | Part of #27065 This reduces the usage of `db.DefaultContext`. I think I've got enough files for the first PR. When this is merged, I will continue working on this. Considering how many files this PR affect, I hope it won't take to long to merge, so I don't end up in the merge conflict hell. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Show OpenID Connect and OAuth on signup page (#20242)Dmitry Sharshakov2023-09-131-0/+18
| | | | | | | | Fix #19809 --------- Signed-off-by: Dmitry Sharshakov <d3dx12.xx@gmail.com> Co-authored-by: jackHay22 <jack@allspice.io>
* Add more descriptive error on forgot password page (#26848)Jack Hay2023-09-011-3/+4
| | | | | | | | ## Changes - Forces flashed error to render immediately when forgot password code is incorrect or has expired. - Adds a link back to the `forgot_password` page so that the user can restart the process (in the event that their link has expired)
* Update team invitation email link (#26550)Jack Hay2023-08-311-0/+11
| | | | | Co-authored-by: Kyle D <kdumontnu@gmail.com> Co-authored-by: Jonathan Tran <jonnytran@gmail.com>
* Start using template context function (#26254)wxiaoguang2023-08-081-1/+1
| | | | | | | | | | | | | | | | | | | | | | Before: * `{{.locale.Tr ...}}` * `{{$.locale.Tr ...}}` * `{{$.root.locale.Tr ...}}` * `{{template "sub" .}}` * `{{template "sub" (dict "locale" $.locale)}}` * `{{template "sub" (dict "root" $)}}` * ..... With context function: only need to `{{ctx.Locale.Tr ...}}` The "ctx" could be considered as a super-global variable for all templates including sub-templates. To avoid potential risks (any bug in the template context function package), this PR only starts using "ctx" in "head.tmpl" and "footer.tmpl" and it has a "DataRaceCheck". If there is anything wrong, the code can be fixed or reverted easily.
* Move web JSON functions to web context and simplify code (#26132)wxiaoguang2023-07-261-1/+1
| | | | | | | | | The JSONRedirect/JSONOK/JSONError functions were put into "Base" context incorrectly, it would cause abuse. Actually, they are for "web context" only, so, move them to the correct place. And by the way, use them to simplify old code: +75 -196
* Bump github.com/golang-jwt/jwt to v5 (#25975)harryzcy2023-07-192-13/+11
| | | | | | | | | | | | | | | | Bumping `github.com/golang-jwt/jwt` from v4 to v5. `github.com/golang-jwt/jwt` v5 is bringing some breaking changes: - standard `Valid()` method on claims is removed. It's replaced by `ClaimsValidator` interface implementing `Validator()` method instead, which is called after standard validation. Gitea doesn't seem to be using this logic. - `jwt.Token` has a field `Valid`, so it's checked in `ParseToken` function in `services/auth/source/oauth2/token.go` --------- Co-authored-by: Giteabot <teabot@gitea.io>
* Less naked returns (#25713)65432023-07-071-8/+8
| | | | | just a step towards #25655 and some related refactoring
* Replace `interface{}` with `any` (#25686)silverwind2023-07-045-15/+15
| | | | | Result of running `perl -p -i -e 's#interface\{\}#any#g' **/*` and `make fmt`. Basically the same [as golang did](https://github.com/golang/go/commit/2580d0e08d5e9f979b943758d3c49877fb2324cb).
* Log the real reason when authentication fails (but don't show the user) (#25414)Lunny Xiao2023-07-033-12/+31
|
* Use JSON response for "user/logout" (#25522)wxiaoguang2023-06-261-1/+1
| | | | The request sent to "user/logout" is from "link-action", it expects to get JSON response.
* Show OAuth2 errors to end users (#25261)wxiaoguang2023-06-151-3/+19
| | | | | | | | | | | | Partially fix #23936 ![image](https://github.com/go-gitea/gitea/assets/2114189/8aa7f3ad-a5f0-42ce-a478-289a03bd08a3) ![image](https://github.com/go-gitea/gitea/assets/2114189/bb901e7d-485a-47a5-b68d-9ebe7013a6b2) ![image](https://github.com/go-gitea/gitea/assets/2114189/9a1ce0f3-f011-4baf-8e2f-cc6304bc9703)
* Allow for PKCE flow without client secret + add docs (#25033)Denys Konovalov2023-06-031-2/+2
| | | | | | | | | | | | | | | | | | | | | | | The PKCE flow according to [RFC 7636](https://datatracker.ietf.org/doc/html/rfc7636) allows for secure authorization without the requirement to provide a client secret for the OAuth app. It is implemented in Gitea since #5378 (v1.8.0), however without being able to omit client secret. Since #21316 Gitea supports setting client type at OAuth app registration. As public clients are already forced to use PKCE since #21316, in this PR the client secret check is being skipped if a public client is detected. As Gitea seems to implement PKCE authorization correctly according to the spec, this would allow for PKCE flow without providing a client secret. Also add some docs for it, please check language as I'm not a native English speaker. Closes #17107 Closes #25047
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-06 21:15:58 +0000