Archer 5c542ca94c Prevent automatic OAuth grants for public clients (#30790) ... This commit forces the resource owner (user) to always approve OAuth 2.0 authorization requests if the client is public (e.g. native applications). As detailed in [RFC 6749 Section 10.2](https://www.rfc-editor.org/rfc/rfc6749.html#section-10.2), > The authorization server SHOULD NOT process repeated authorization requests automatically (without active resource owner interaction) without authenticating the client or relying on other measures to ensure that the repeated request comes from the original client and not an impersonator. With the implementation prior to this patch, attackers with access to the redirect URI (e.g., the loopback interface for `git-credential-oauth`) can get access to the user account without any user interaction if they can redirect the user to the `/login/oauth/authorize` endpoint somehow (e.g., with `xdg-open` on Linux). Fixes #25061. Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>		2024-05-02 17:05:59 +00:00
..
admin	Resolve lint for unused parameter and unnecessary type arguments (#30750)	2024-04-29 08:47:56 +00:00
auth	Prevent automatic OAuth grants for public clients (#30790)	2024-05-02 17:05:59 +00:00
devtest
events
explore
feed	Resolve lint for unused parameter and unnecessary type arguments (#30750)	2024-04-29 08:47:56 +00:00
healthcheck
misc
org
repo	Fix bleve fuzziness (#30799)	2024-05-01 15:32:52 +03:00
shared
user
base.go
githttp.go
goget.go
home.go
metrics.go
nodeinfo.go
passkey.go
swagger_json.go
web.go	Skip gzip for some well-known compressed file types (#30796)	2024-05-02 02:27:25 +00:00
webfinger.go