gitea/services
Jack Hay 4e879fed90
Deprecate query string auth tokens (#28390)
## Changes
- Add deprecation warning to `Token` and `AccessToken` authentication
methods in swagger.
- Add deprecation warning header to API response. Example: 
  ```
  HTTP/1.1 200 OK
  ...
  Warning: token and access_token API authentication is deprecated
  ...
  ```
- Add setting `DISABLE_QUERY_AUTH_TOKEN` to reject query string auth
tokens entirely. Default is `false`

## Next steps
- `DISABLE_QUERY_AUTH_TOKEN` should be true in a subsequent release and
the methods should be removed in swagger
- `DISABLE_QUERY_AUTH_TOKEN` should be removed and the implementation of
the auth methods in question should be removed

## Open questions
- Should there be further changes to the swagger documentation?
Deprecation is not yet supported for security definitions (coming in
[OpenAPI Spec version
3.2.0](https://github.com/OAI/OpenAPI-Specification/issues/2506))
- Should the API router logger sanitize urls that use `token` or
`access_token`? (This is obviously an insufficient solution on its own)

---------

Co-authored-by: delvh <dev.lh@web.de>
2023-12-12 03:48:53 +00:00
..
actions Use db.Find instead of writing methods for every object (#28084) 2023-11-24 03:49:41 +00:00
agit Penultimate round of db.DefaultContext refactor (#27414) 2023-10-11 04:24:07 +00:00
asymkey Use db.Find instead of writing methods for every object (#28084) 2023-11-24 03:49:41 +00:00
attachment Even more db.DefaultContext refactor (#27352) 2023-10-03 10:30:41 +00:00
auth Deprecate query string auth tokens (#28390) 2023-12-12 03:48:53 +00:00
automerge Improve queue and logger context (#24924) 2023-05-26 07:31:55 +00:00
context Another round of db.DefaultContext refactor (#27103) 2023-09-25 13:17:37 +00:00
convert Fix package webhook (#27839) 2023-10-31 04:43:38 +00:00
cron Actually recover from a panic in cron task (#28409) 2023-12-10 20:15:06 +00:00
externalaccount Final round of db.DefaultContext refactor (#27587) 2023-10-14 08:37:24 +00:00
feed More db.DefaultContext refactor (#27265) 2023-09-29 12:12:54 +00:00
forms Fix required error for token name (#28267) 2023-11-29 03:47:05 +00:00
gitdiff Even more db.DefaultContext refactor (#27352) 2023-10-03 10:30:41 +00:00
indexer Fix missing issue search index update when changing status (#28325) 2023-12-03 12:22:44 +01:00
issue Penultimate round of db.DefaultContext refactor (#27414) 2023-10-11 04:24:07 +00:00
lfs Remove GetByBean method because sometimes it's danger when query condition parameter is zero and also introduce new generic methods (#28220) 2023-12-07 15:27:36 +08:00
mailer Fix missing mail reply address (#27997) 2023-11-13 03:20:34 +00:00
markup make writing main test easier (#27270) 2023-09-28 01:38:53 +00:00
migrations Second part of refactor db.Find (#28194) 2023-12-11 16:56:48 +08:00
mirror Even more db.DefaultContext refactor (#27352) 2023-10-03 10:30:41 +00:00
notify Update status and code index after changing the default branch (#27018) 2023-09-13 04:43:31 +00:00
org Delete repos of org when purge delete user (#27273) 2023-10-19 13:16:11 +00:00
packages Fix RPM/Debian signature key creation (#28352) 2023-12-05 00:48:01 +00:00
pull Remove GetByBean method because sometimes it's danger when query condition parameter is zero and also introduce new generic methods (#28220) 2023-12-07 15:27:36 +08:00
release Fix comment permissions (#28213) 2023-11-25 17:21:21 +00:00
repository Second part of refactor db.Find (#28194) 2023-12-11 16:56:48 +08:00
secrets Use db.Find instead of writing methods for every object (#28084) 2023-11-24 03:49:41 +00:00
task Fix incorrect ctx usage in defer function (#27740) 2023-10-22 14:12:27 +00:00
uinotification Penultimate round of db.DefaultContext refactor (#27414) 2023-10-11 04:24:07 +00:00
user Use db.Find instead of writing methods for every object (#28084) 2023-11-24 03:49:41 +00:00
webhook Use db.Find instead of writing methods for every object (#28084) 2023-11-24 03:49:41 +00:00
wiki Even more db.DefaultContext refactor (#27352) 2023-10-03 10:30:41 +00:00