0e3a5abb69
Backport #28390 by @jackHay22
## Changes
- Add deprecation warning to `Token` and `AccessToken` authentication
methods in swagger.
- Add deprecation warning header to API response. Example:
```
HTTP/1.1 200 OK
...
Warning: token and access_token API authentication is deprecated
...
```
- Add setting `DISABLE_QUERY_AUTH_TOKEN` to reject query string auth
tokens entirely. Default is `false`
## Next steps
- `DISABLE_QUERY_AUTH_TOKEN` should be true in a subsequent release and
the methods should be removed in swagger
- `DISABLE_QUERY_AUTH_TOKEN` should be removed and the implementation of
the auth methods in question should be removed
## Open questions
- Should there be further changes to the swagger documentation?
Deprecation is not yet supported for security definitions (coming in
[OpenAPI Spec version
3.2.0](https://github.com/OAI/OpenAPI-Specification/issues/2506))
- Should the API router logger sanitize urls that use `token` or
`access_token`? (This is obviously an insufficient solution on its own)
Co-authored-by: Jack Hay <jack@allspice.io>
Co-authored-by: delvh <dev.lh@web.de>
(cherry picked from commit
|
||
---|---|---|
.. | ||
actions | ||
agit | ||
asymkey | ||
attachment | ||
auth | ||
automerge | ||
context | ||
convert | ||
cron | ||
externalaccount | ||
feed | ||
forgejo | ||
forms | ||
gitdiff | ||
indexer | ||
issue | ||
lfs | ||
mailer | ||
markup | ||
migrations | ||
mirror | ||
notify | ||
org | ||
packages | ||
pull | ||
release | ||
repository | ||
secrets | ||
task | ||
uinotification | ||
user | ||
webhook | ||
wiki |