MirrorHub/forgejo
0
0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2024-12-05 00:08:06 +01:00
Code Issues Projects Releases Packages Wiki Activity
forgejo/routers/web
History
Gusted 6404845df9
[v1.21] [GITEA] rework long-term authentication 
- The current architecture is inherently insecure, because you can
construct the 'secret' cookie value with values that are available in
the database. Thus provides zero protection when a database is
dumped/leaked.
- This patch implements a new architecture that's inspired from: [Paragonie Initiative](https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies).
- Integration testing is added to ensure the new mechanism works.
- Removes a setting, because it's not used anymore.

(cherry picked from commit eff097448b)

[GITEA] rework long-term authentication (squash) add migration

Reminder: the migration is run via integration tests as explained
in the commit "[DB] run all Forgejo migrations in integration tests"

(cherry picked from commit 4accf7443c)
(cherry picked from commit 99d06e344ebc3b50bafb2ac4473dd95f057d1ddc)
(cherry picked from commit d8bc98a8f0)
2023-10-16 17:27:03 +02:00
..
admin Refactor system setting (#27000) (#27452) 2023-10-05 10:37:59 +00:00
auth [v1.21] [GITEA] rework long-term authentication 2023-10-16 17:27:03 +02:00
devtest Make "cancel" buttons have proper type in modal forms (#25618) 2023-07-03 14:04:50 +08:00
events
explore Next round of db.DefaultContext refactor (#27089) 2023-09-16 14:39:12 +00:00
feed [GITEA] convert feed items' titles to plain text 2023-10-16 17:26:43 +02:00
healthcheck Remove db.DefaultContext in routers/ and cmd/ (#26076) 2023-07-23 23:47:27 -04:00
misc [API] Forgejo API /api/forgejo/v1 2023-10-16 15:50:09 +02:00
org More db.DefaultContext refactor (#27265) (#27347) 2023-09-29 13:35:01 +00:00
repo [GITEA] Detect file rename and show in history 2023-10-16 17:25:37 +02:00
shared Introduce fixes and more rigorous tests for 'Show on a map' feature (#26803) (#27365) 2023-09-30 15:58:35 +00:00
user [v1.21] [GITEA] rework long-term authentication 2023-10-16 17:27:03 +02:00
base.go Fix panic in storageHandler (#27446) (#27479) 2023-10-06 16:51:26 +02:00
goget.go
home.go [v1.21] [GITEA] rework long-term authentication 2023-10-16 17:27:03 +02:00
metrics.go
nodeinfo.go
swagger_json.go Start using template context function (#26254) 2023-08-08 01:22:47 +00:00
web.go [v1.21] [GITEA] rework long-term authentication 2023-10-16 17:27:03 +02:00
webfinger.go Add a link to OpenID Issuer URL in WebFinger response (#26000) 2023-07-20 16:02:45 +08:00