gitea/templates
Giteabot f144521aea
Deprecate query string auth tokens (#28390) (#28430)
Backport #28390 by @jackHay22

## Changes
- Add deprecation warning to `Token` and `AccessToken` authentication
methods in swagger.
- Add deprecation warning header to API response. Example: 
  ```
  HTTP/1.1 200 OK
  ...
  Warning: token and access_token API authentication is deprecated
  ...
  ```
- Add setting `DISABLE_QUERY_AUTH_TOKEN` to reject query string auth
tokens entirely. Default is `false`

## Next steps
- `DISABLE_QUERY_AUTH_TOKEN` should be true in a subsequent release and
the methods should be removed in swagger
- `DISABLE_QUERY_AUTH_TOKEN` should be removed and the implementation of
the auth methods in question should be removed

## Open questions
- Should there be further changes to the swagger documentation?
Deprecation is not yet supported for security definitions (coming in
[OpenAPI Spec version
3.2.0](https://github.com/OAI/OpenAPI-Specification/issues/2506))
- Should the API router logger sanitize urls that use `token` or
`access_token`? (This is obviously an insufficient solution on its own)

Co-authored-by: Jack Hay <jack@allspice.io>
Co-authored-by: delvh <dev.lh@web.de>
2023-12-12 13:45:00 +08:00
..
admin Add word break to the repo list in admin settings page (#28034) (#28035) 2023-11-14 14:31:43 +08:00
api/packages/pypi Remove incorrect HTML self close tag (#23748) 2023-03-27 18:05:51 +02:00
base Backport ctx locale refactoring manually (#27231) (#27259) (#27260) 2023-09-25 13:15:51 +00:00
code Backport ctx locale refactoring manually (#27231) (#27259) (#27260) 2023-09-25 13:15:51 +00:00
custom Add footer extra links template (#9576) 2020-01-03 20:41:56 +02:00
devtest Improve dropdown button alignment and fix hover bug (#27632) (#27637) 2023-10-16 16:15:15 +08:00
explore Keep profile tab when clicking on Language (#28320) (#28331) 2023-12-03 14:54:53 +00:00
mail Update team invitation email link (#26550) 2023-08-31 16:26:13 +00:00
org Use full width for project boards (#28225) (#28245) 2023-11-27 18:20:53 +00:00
package Do not display search box when there's no packages yet (#28146) (#28159) 2023-11-22 10:07:13 +08:00
projects Use full width for project boards (#28225) (#28245) 2023-11-27 18:20:53 +00:00
repo Fix margin in server signed signature verification view (#28379) (#28381) 2023-12-07 10:37:12 +08:00
shared Refactor template empty checks (#28351) (#28354) 2023-12-05 06:07:15 +00:00
status Clean up template locale usage (#27856) (#27857) 2023-10-31 17:35:55 +01:00
swagger Deprecate query string auth tokens (#28390) (#28430) 2023-12-12 13:45:00 +08:00
user Refactor template empty checks (#28351) (#28354) 2023-12-05 06:07:15 +00:00
webhook Extract common code to new template (#26933) 2023-09-06 10:11:06 +00:00
home.tmpl Backport ctx locale refactoring manually (#27231) (#27259) (#27260) 2023-09-25 13:15:51 +00:00
install.tmpl Backport ctx locale refactoring manually (#27231) (#27259) (#27260) 2023-09-25 13:15:51 +00:00
post-install.tmpl Backport ctx locale refactoring manually (#27231) (#27259) (#27260) 2023-09-25 13:15:51 +00:00