forgejo/services
Giteabot 0e3a5abb69
Deprecate query string auth tokens (#28390) (#28430)
Backport #28390 by @jackHay22

## Changes
- Add deprecation warning to `Token` and `AccessToken` authentication
methods in swagger.
- Add deprecation warning header to API response. Example:
  ```
  HTTP/1.1 200 OK
  ...
  Warning: token and access_token API authentication is deprecated
  ...
  ```
- Add setting `DISABLE_QUERY_AUTH_TOKEN` to reject query string auth
tokens entirely. Default is `false`

## Next steps
- `DISABLE_QUERY_AUTH_TOKEN` should be true in a subsequent release and
the methods should be removed in swagger
- `DISABLE_QUERY_AUTH_TOKEN` should be removed and the implementation of
the auth methods in question should be removed

## Open questions
- Should there be further changes to the swagger documentation?
Deprecation is not yet supported for security definitions (coming in
[OpenAPI Spec version
3.2.0](https://github.com/OAI/OpenAPI-Specification/issues/2506))
- Should the API router logger sanitize urls that use `token` or
`access_token`? (This is obviously an insufficient solution on its own)

Co-authored-by: Jack Hay <jack@allspice.io>
Co-authored-by: delvh <dev.lh@web.de>
(cherry picked from commit f144521aea)
2023-12-12 15:21:33 +01:00
..
actions Always delete existing scheduled action tasks (#27662) (#27688) 2023-10-19 09:37:20 +02:00
agit Move notification interface to services layer (#26915) 2023-09-05 18:37:47 +00:00
asymkey Another round of db.DefaultContext refactor (#27103) (#27262) 2023-09-25 19:24:35 +02:00
attachment [FEAT] allow setting the update date on issues and comments 2023-11-13 12:33:49 +01:00
auth Deprecate query string auth tokens (#28390) (#28430) 2023-12-12 15:21:33 +01:00
automerge Improve queue and logger context (#24924) 2023-05-26 07:31:55 +00:00
context Another round of db.DefaultContext refactor (#27103) (#27262) 2023-09-25 19:24:35 +02:00
convert [FEAT] add Forgero Git Service 2023-11-13 12:33:49 +01:00
cron [GITEA] Actually recover from a panic in cron task 2023-12-10 17:20:49 +01:00
externalaccount More db.DefaultContext refactor (#27265) (#27347) 2023-09-29 13:35:01 +00:00
feed More db.DefaultContext refactor (#27265) (#27347) 2023-09-29 13:35:01 +00:00
forgejo [UPGRADE] add sanity checks for [storage*] 2023-11-13 12:33:49 +01:00
forms [GITEA] Fix required error for token name 2023-11-13 14:06:32 +01:00
gitdiff Fix successful return value for SyncAndGetUserSpecificDiff (#27152) 2023-09-20 22:28:17 +02:00
indexer Fix missing issue search index update when changing status (#28325) (#28330) 2023-12-08 13:41:16 +01:00
issue [MODERATION] User blocking 2023-11-13 13:58:02 +01:00
lfs [GITEA] Drop sha256-simd in favor of stdlib 2023-11-13 14:06:31 +01:00
mailer [GITEA] notifies admins on new user registration (squash) fix locale 2023-12-06 18:36:17 +01:00
markup Move web/api context related testing function into a separate package (#26859) 2023-09-01 11:26:07 +00:00
migrations Fix migration panic due to an empty review comment diff (#28334) (#28362) 2023-12-08 13:41:16 +01:00
mirror More db.DefaultContext refactor (#27265) (#27347) 2023-09-29 13:35:01 +00:00
notify [GITEA] notifies admins on new user registration 2023-11-13 14:06:27 +01:00
org Delete repos of org when purge delete user (#27273) (#27728) 2023-11-01 10:03:12 +08:00
packages Fix RPM/Debian signature key creation (#28352) (#28353) 2023-12-08 13:41:16 +01:00
pull [MODERATION] User blocking 2023-11-13 13:58:02 +01:00
release Fix comment permissions (#28213) (#28216) 2023-11-26 13:56:50 +01:00
repository Also sync DB branches on push if necessary (#28361) (#28403) 2023-12-12 15:21:33 +01:00
secrets Refactor secrets modification logic (#26873) 2023-09-05 15:21:02 +00:00
task Fix incorrect ctx usage in defer function (#27740) (#27741) 2023-10-22 14:36:49 +00:00
uinotification More db.DefaultContext refactor (#27265) (#27347) 2023-09-29 13:35:01 +00:00
user [MODERATION] User blocking 2023-11-13 13:58:02 +01:00
webhook Fix comment permissions (#28213) (#28216) 2023-11-26 13:56:50 +01:00
wiki Fix incorrect test code for error handling (#27139) 2023-09-20 08:51:36 +08:00