forgejo/services/auth
Giteabot f144521aea
Deprecate query string auth tokens (#28390) (#28430)
Backport #28390 by @jackHay22

## Changes
- Add deprecation warning to `Token` and `AccessToken` authentication
methods in swagger.
- Add deprecation warning header to API response. Example: 
  ```
  HTTP/1.1 200 OK
  ...
  Warning: token and access_token API authentication is deprecated
  ...
  ```
- Add setting `DISABLE_QUERY_AUTH_TOKEN` to reject query string auth
tokens entirely. Default is `false`

## Next steps
- `DISABLE_QUERY_AUTH_TOKEN` should be true in a subsequent release and
the methods should be removed in swagger
- `DISABLE_QUERY_AUTH_TOKEN` should be removed and the implementation of
the auth methods in question should be removed

## Open questions
- Should there be further changes to the swagger documentation?
Deprecation is not yet supported for security definitions (coming in
[OpenAPI Spec version
3.2.0](https://github.com/OAI/OpenAPI-Specification/issues/2506))
- Should the API router logger sanitize urls that use `token` or
`access_token`? (This is obviously an insufficient solution on its own)

Co-authored-by: Jack Hay <jack@allspice.io>
Co-authored-by: delvh <dev.lh@web.de>
2023-12-12 13:45:00 +08:00
..
source Another round of db.DefaultContext refactor (#27103) (#27262) 2023-09-25 19:24:35 +02:00
auth.go Fix attachment download bug (#27486) (#27571) 2023-10-11 04:39:12 +02:00
auth_test.go Fix attachment download bug (#27486) (#27571) 2023-10-11 04:39:12 +02:00
basic.go Unify two factor check (#27915) (#27929) 2023-11-06 18:07:22 +00:00
group.go Remove Named interface (#26913) 2023-09-05 15:58:30 +00:00
httpsign.go Remove Named interface (#26913) 2023-09-05 15:58:30 +00:00
interface.go Reduce usage of db.DefaultContext (#27073) 2023-09-14 17:09:32 +00:00
oauth2.go Deprecate query string auth tokens (#28390) (#28430) 2023-12-12 13:45:00 +08:00
reverseproxy.go Fix attachment download bug (#27486) (#27571) 2023-10-11 04:39:12 +02:00
session.go Remove Named interface (#26913) 2023-09-05 15:58:30 +00:00
signin.go Reduce usage of db.DefaultContext (#27073) 2023-09-14 17:09:32 +00:00
source.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
sspi.go Make SSPI auth mockable (#27036) 2023-09-17 23:32:56 +00:00
sspiauth_posix.go Make SSPI auth mockable (#27036) 2023-09-17 23:32:56 +00:00
sspiauth_windows.go Make SSPI auth mockable (#27036) 2023-09-17 23:32:56 +00:00
sync.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00