forgejo/templates
Jack Hay 4e879fed90
Deprecate query string auth tokens (#28390)
## Changes
- Add deprecation warning to `Token` and `AccessToken` authentication
methods in swagger.
- Add deprecation warning header to API response. Example: 
  ```
  HTTP/1.1 200 OK
  ...
  Warning: token and access_token API authentication is deprecated
  ...
  ```
- Add setting `DISABLE_QUERY_AUTH_TOKEN` to reject query string auth
tokens entirely. Default is `false`

## Next steps
- `DISABLE_QUERY_AUTH_TOKEN` should be true in a subsequent release and
the methods should be removed in swagger
- `DISABLE_QUERY_AUTH_TOKEN` should be removed and the implementation of
the auth methods in question should be removed

## Open questions
- Should there be further changes to the swagger documentation?
Deprecation is not yet supported for security definitions (coming in
[OpenAPI Spec version
3.2.0](https://github.com/OAI/OpenAPI-Specification/issues/2506))
- Should the API router logger sanitize urls that use `token` or
`access_token`? (This is obviously an insufficient solution on its own)

---------

Co-authored-by: delvh <dev.lh@web.de>
2023-12-12 03:48:53 +00:00
..
admin Remove autofocus in search box (#28033) 2023-11-20 08:57:46 +00:00
api/packages/pypi
base Rename the default themes to gitea-light, gitea-dark, gitea-auto (#27419) 2023-10-06 09:46:36 +02:00
code Remove autofocus in search box (#28033) 2023-11-20 08:57:46 +00:00
custom
devtest Improve dropdown button alignment and fix hover bug (#27632) 2023-10-16 07:26:08 +00:00
explore Keep profile tab when clicking on Language (#28320) 2023-12-01 22:31:40 +02:00
mail
org Issue fixes for RSS feed improvements (#28380) 2023-12-07 03:01:32 +00:00
package Let curl write the content to file (#28427) 2023-12-12 07:19:30 +08:00
projects Use full width for project boards (#28225) 2023-11-27 17:43:52 +00:00
repo Issue fixes for RSS feed improvements (#28380) 2023-12-07 03:01:32 +00:00
shared Refactor template empty checks (#28351) 2023-12-04 15:48:42 -06:00
status Clean up template locale usage (#27856) 2023-10-31 22:11:48 +08:00
swagger Deprecate query string auth tokens (#28390) 2023-12-12 03:48:53 +00:00
user Improve text in Security settings (#28393) 2023-12-08 00:38:55 +02:00
webhook Extract common code to new template (#26933) 2023-09-06 10:11:06 +00:00
home.tmpl Fix more "locale" usages (#27259) 2023-09-25 20:42:40 +08:00
install.tmpl Fix more "locale" usages (#27259) 2023-09-25 20:42:40 +08:00
post-install.tmpl Always use ctx.Locale.Tr inside templates (#27231) 2023-09-25 08:56:50 +00:00