gitea

public/gitea

0 Fork 0

mirror of https://github.com/go-gitea/gitea.git synced 2026-10-26 06:16:56 +09:00

Files

T

History

fixfonandsilverwind aaeb502b30 fix(oauth2): decode form-encoded client credentials in HTTP Basic auth (#39926 )

Fixes https://github.com/go-gitea/gitea/issues/39925

RFC 6749 §2.3.1 has clients form-urlencode the client id and secret
before building the HTTP Basic header. `openid-client` with
`client_secret_basic` does this and sends `-` as `%2D` and `_` as `%5F`.
The token and introspection endpoints used the raw header values, so
these clients failed with `invalid_client`. Both endpoints now decode
the values with `url.QueryUnescape` before the client lookup, the secret
check and the body consistency check, and reject a value that does not
decode. Plain HTTP Basic parsing in `httpauth` is unchanged, since the
encoding only applies to OAuth client authentication.

Clients that don't encode are unaffected, since no client id or secret
Gitea has ever issued contains `+` or `%`.

---------

Co-authored-by: silverwind <me@silverwind.io>

2026-10-22 04:18:43 +00:00

2fa.go

feat: Add audit logging (#38189 )

2026-09-12 08:15:23 +00:00

auth_test.go

fix(auth): avoid "compromised account" false-alarm when login with remember-me token (#39686 )

2026-10-12 08:44:52 +00:00

auth.go

fix(auth): avoid "compromised account" false-alarm when login with remember-me token (#39686 )

2026-10-12 08:44:52 +00:00

linkaccount.go

refactor: move go-chi/captcha into Gitea (#39529 )