1
0
mirror of https://github.com/go-gitea/gitea.git synced 2024-12-23 21:34:43 +03:00
gitea/routers/api/v1
Jack Hay 4e879fed90
Deprecate query string auth tokens (#28390)
## Changes
- Add deprecation warning to `Token` and `AccessToken` authentication
methods in swagger.
- Add deprecation warning header to API response. Example: 
  ```
  HTTP/1.1 200 OK
  ...
  Warning: token and access_token API authentication is deprecated
  ...
  ```
- Add setting `DISABLE_QUERY_AUTH_TOKEN` to reject query string auth
tokens entirely. Default is `false`

## Next steps
- `DISABLE_QUERY_AUTH_TOKEN` should be true in a subsequent release and
the methods should be removed in swagger
- `DISABLE_QUERY_AUTH_TOKEN` should be removed and the implementation of
the auth methods in question should be removed

## Open questions
- Should there be further changes to the swagger documentation?
Deprecation is not yet supported for security definitions (coming in
[OpenAPI Spec version
3.2.0](https://github.com/OAI/OpenAPI-Specification/issues/2506))
- Should the API router logger sanitize urls that use `token` or
`access_token`? (This is obviously an insufficient solution on its own)

---------

Co-authored-by: delvh <dev.lh@web.de>
2023-12-12 03:48:53 +00:00
..
activitypub More refactoring of db.DefaultContext (#27083) 2023-09-15 06:13:19 +00:00
admin Penultimate round of db.DefaultContext refactor (#27414) 2023-10-11 04:24:07 +00:00
misc More db.DefaultContext refactor (#27265) 2023-09-29 12:12:54 +00:00
notify Use db.Find instead of writing methods for every object (#28084) 2023-11-24 03:49:41 +00:00
org Use db.Find instead of writing methods for every object (#28084) 2023-11-24 03:49:41 +00:00
packages Another round of db.DefaultContext refactor (#27103) 2023-09-25 13:17:37 +00:00
repo Second part of refactor db.Find (#28194) 2023-12-11 16:56:48 +08:00
settings Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
swagger refactor(API): refactor secret creation and update functionality (#26751) 2023-08-28 13:08:19 +08:00
user Fix comment permissions (#28213) 2023-11-25 17:21:21 +00:00
utils Use db.Find instead of writing methods for every object (#28084) 2023-11-24 03:49:41 +00:00
api.go Deprecate query string auth tokens (#28390) 2023-12-12 03:48:53 +00:00