Jack Hay 4e879fed90 Deprecate query string auth tokens (#28390) ... ## Changes - Add deprecation warning to `Token` and `AccessToken` authentication methods in swagger. - Add deprecation warning header to API response. Example: ``` HTTP/1.1 200 OK ... Warning: token and access_token API authentication is deprecated ... ``` - Add setting `DISABLE_QUERY_AUTH_TOKEN` to reject query string auth tokens entirely. Default is `false` ## Next steps - `DISABLE_QUERY_AUTH_TOKEN` should be true in a subsequent release and the methods should be removed in swagger - `DISABLE_QUERY_AUTH_TOKEN` should be removed and the implementation of the auth methods in question should be removed ## Open questions - Should there be further changes to the swagger documentation? Deprecation is not yet supported for security definitions (coming in [OpenAPI Spec version 3.2.0](https://github.com/OAI/OpenAPI-Specification/issues/2506)) - Should the API router logger sanitize urls that use `token` or `access_token`? (This is obviously an insufficient solution on its own) --------- Co-authored-by: delvh <dev.lh@web.de>		2023-12-12 03:48:53 +00:00
..
config
actions_test.go
actions.go
admin.go
api.go
asset_dynamic.go
asset_static.go
attachment_test.go
attachment.go
cache.go
camo.go
config_env_test.go
config_env.go
config_provider_test.go
config_provider.go
config.go
cors.go
cron_test.go
cron.go
database_sqlite.go
database_test.go
database.go
federation.go
git_test.go
git.go
highlight.go
i18n.go
incoming_email.go
indexer_test.go
indexer.go
lfs_test.go
lfs.go
log_test.go
log.go
mailer_test.go
mailer.go
markup.go
metrics.go
migrations.go
mime_type_map.go
mirror.go
oauth2.go
other.go
packages_test.go
packages.go
path_test.go
path.go
picture.go
project.go
proxy.go
queue.go
repository_archive_test.go
repository_archive.go
repository.go
security.go	Deprecate query string auth tokens (#28390)	2023-12-12 03:48:53 +00:00
server.go
service_test.go
service.go
session.go
setting_test.go
setting.go
ssh.go
storage_test.go
storage.go
task.go
time.go
ui.go
webhook.go