forgejo/templates
Giteabot 0e3a5abb69
Deprecate query string auth tokens (#28390) (#28430)
Backport #28390 by @jackHay22

## Changes
- Add deprecation warning to `Token` and `AccessToken` authentication
methods in swagger.
- Add deprecation warning header to API response. Example:
  ```
  HTTP/1.1 200 OK
  ...
  Warning: token and access_token API authentication is deprecated
  ...
  ```
- Add setting `DISABLE_QUERY_AUTH_TOKEN` to reject query string auth
tokens entirely. Default is `false`

## Next steps
- `DISABLE_QUERY_AUTH_TOKEN` should be true in a subsequent release and
the methods should be removed in swagger
- `DISABLE_QUERY_AUTH_TOKEN` should be removed and the implementation of
the auth methods in question should be removed

## Open questions
- Should there be further changes to the swagger documentation?
Deprecation is not yet supported for security definitions (coming in
[OpenAPI Spec version
3.2.0](https://github.com/OAI/OpenAPI-Specification/issues/2506))
- Should the API router logger sanitize urls that use `token` or
`access_token`? (This is obviously an insufficient solution on its own)

Co-authored-by: Jack Hay <jack@allspice.io>
Co-authored-by: delvh <dev.lh@web.de>
(cherry picked from commit f144521aea)
2023-12-12 15:21:33 +01:00
..
admin Add word break to the repo list in admin settings page (#28034) (#28035) 2023-11-22 17:11:57 +01:00
api/packages/pypi Remove incorrect HTML self close tag (#23748) 2023-03-27 18:05:51 +02:00
base Merge branch 'rebase-v1.21/forgejo-branding' into wip-v1.21-forgejo 2023-11-13 16:47:18 +01:00
code Backport ctx locale refactoring manually (#27231) (#27259) (#27260) 2023-09-25 13:15:51 +00:00
custom Add footer extra links template (#9576) 2020-01-03 20:41:56 +02:00
devtest Improve dropdown button alignment and fix hover bug (#27632) (#27637) 2023-10-16 16:15:15 +08:00
explore Keep profile tab when clicking on Language (#28320) (#28331) 2023-12-08 13:41:16 +01:00
mail [GITEA] notifies admins on new user registration (squash) fix locale 2023-12-06 18:36:17 +01:00
org Use full width for project boards (#28225) (#28245) 2023-12-08 13:40:59 +01:00
package Do not display search box when there's no packages yet (#28146) (#28159) 2023-11-22 17:12:12 +01:00
projects Use full width for project boards (#28225) (#28245) 2023-12-08 13:40:59 +01:00
repo Fix margin in server signed signature verification view (#28379) (#28381) 2023-12-08 13:41:16 +01:00
shared Refactor template empty checks (#28351) (#28354) 2023-12-08 13:41:16 +01:00
status Clean up template locale usage (#27856) (#27857) 2023-10-31 17:35:55 +01:00
swagger Deprecate query string auth tokens (#28390) (#28430) 2023-12-12 15:21:33 +01:00
user Refactor template empty checks (#28351) (#28354) 2023-12-08 13:41:16 +01:00
webhook [BRANDING] add the forgejo webhook type & update webhook docs URLs 2023-11-13 13:58:18 +01:00
home.tmpl Backport ctx locale refactoring manually (#27231) (#27259) (#27260) 2023-09-25 13:15:51 +00:00
install.tmpl Merge branch 'rebase-v1.21/forgejo-branding' into wip-v1.21-forgejo 2023-11-13 16:47:18 +01:00
post-install.tmpl [BRANDING] Custom loading animation for Forgejo 2023-11-13 13:58:17 +01:00