mirror of
https://github.com/go-gitea/gitea.git
synced 2026-10-26 06:16:56 +09:00
GiteabotandShivansh Garg
0001e58e6b
Backport #39498 by @SHIVANSHGARG07 The OIDC discovery document at `/.well-known/openid-configuration` advertised `id_token` in `response_types_supported`, but `/login/oauth/authorize` only implements the authorization code flow and rejects any other response_type with `unsupported_response_type`. This mismatch caused OIDC client libraries that rely on discovery to attempt the implicit flow and fail silently. This removes `id_token` from `response_types_supported` so discovery matches actual server behavior, and adds an integration test asserting `response_type=id_token` is rejected consistently. Manually verified: rebuilt Gitea, registered an OAuth2 app, confirmed `/.well-known/openid-configuration` no longer lists `id_token`, and confirmed `/login/oauth/authorize?...&response_type=id_token` still correctly returns `error=unsupported_response_type`. Fixes #39482. <!-- Before submitting: - Target the `main` branch; release branches are for backports only. - Use a Conventional Commits title, e.g. `fix(repo): handle empty branch names`. - Read the contributing guidelines: https://github.com/go-gitea/gitea/blob/main/CONTRIBUTING.md - Documentation changes go to https://gitea.com/gitea/docs Describe your change below and link any issue it fixes. --> Co-authored-by: Shivansh Garg <shivanshgarg587@gmail.com>
70 lines
1.8 KiB
Go
70 lines
1.8 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package auth
|
|
|
|
import (
|
|
"net/http"
|
|
"strings"
|
|
|
|
"gitea.dev/modules/setting"
|
|
"gitea.dev/services/context"
|
|
"gitea.dev/services/oauth2_provider"
|
|
)
|
|
|
|
// OIDCWellKnown generates JSON so OIDC clients know Gitea's capabilities
|
|
func OIDCWellKnown(ctx *context.Context) {
|
|
if !setting.OAuth2.Enabled {
|
|
http.NotFound(ctx.Resp, ctx.Req)
|
|
return
|
|
}
|
|
jwtRegisteredClaims := oauth2_provider.NewJwtRegisteredClaimsFromUser("well-known", 0, nil)
|
|
oidcIssuer := jwtRegisteredClaims.Issuer // use the consistent issuer from the JWT registered claims
|
|
oidcBaseUrl := strings.TrimSuffix(setting.AppURL, "/")
|
|
|
|
m := map[string]any{
|
|
"issuer": oidcIssuer,
|
|
"authorization_endpoint": oidcBaseUrl + "/login/oauth/authorize",
|
|
"token_endpoint": oidcBaseUrl + "/login/oauth/access_token",
|
|
"jwks_uri": oidcBaseUrl + "/login/oauth/keys",
|
|
"userinfo_endpoint": oidcBaseUrl + "/login/oauth/userinfo",
|
|
"introspection_endpoint": oidcBaseUrl + "/login/oauth/introspect",
|
|
"response_types_supported": []string{
|
|
"code",
|
|
},
|
|
"id_token_signing_alg_values_supported": []string{
|
|
oauth2_provider.DefaultSigningKey.SigningMethod().Alg(),
|
|
},
|
|
"subject_types_supported": []string{
|
|
"public",
|
|
},
|
|
"scopes_supported": oauth2_provider.GeneralScopesSupported(),
|
|
"claims_supported": []string{
|
|
"aud",
|
|
"exp",
|
|
"iat",
|
|
"iss",
|
|
"sub",
|
|
"name",
|
|
"preferred_username",
|
|
"profile",
|
|
"picture",
|
|
"website",
|
|
"locale",
|
|
"updated_at",
|
|
"email",
|
|
"email_verified",
|
|
"groups",
|
|
},
|
|
"code_challenge_methods_supported": []string{
|
|
"plain",
|
|
"S256",
|
|
},
|
|
"grant_types_supported": []string{
|
|
"authorization_code",
|
|
"refresh_token",
|
|
},
|
|
}
|
|
ctx.JSON(http.StatusOK, m)
|
|
}
|