mirror of
https://github.com/go-gitea/gitea
synced 2024-08-20 17:24:51 +02:00
The PKCE flow according to [RFC 7636](https://datatracker.ietf.org/doc/html/rfc7636) allows for secure authorization without the requirement to provide a client secret for the OAuth app. It is implemented in Gitea since #5378 (v1.8.0), however without being able to omit client secret. Since #21316 Gitea supports setting client type at OAuth app registration. As public clients are already forced to use PKCE since #21316, in this PR the client secret check is being skipped if a public client is detected. As Gitea seems to implement PKCE authorization correctly according to the spec, this would allow for PKCE flow without providing a client secret. Also add some docs for it, please check language as I'm not a native English speaker. Closes #17107 Closes #25047 |
||
---|---|---|
.. | ||
e2e | ||
fuzz | ||
gitea-lfs-meta | ||
gitea-repositories-meta | ||
integration | ||
mssql.ini.tmpl | ||
mysql.ini.tmpl | ||
mysql8.ini.tmpl | ||
pgsql.ini.tmpl | ||
sqlite.ini.tmpl | ||
test_utils.go |