gitea

Mirrors/gitea

0 Fork 0

mirror of https://github.com/go-gitea/gitea.git synced 2026-10-12 23:14:23 +02:00

Files

T

History

Shivansh Gargandwxiaoguang f270534e83 fix: validate "scope" for OAuth2, "state" for OpenID (#39642 )

1. Fixes: https://github.com/go-gitea/gitea/issues/39641
* The OAuth2 authorize/grant endpoint accepted and persisted arbitrary
scope strings without validation, unlike personal access token creation
which rejects unknown scopes. Normalize and validate form.Scope before
creating or updating a grant, ignore invalid scopes
* `// TODO: at the moment invalid tokens are treated as "all" to avoid
breaking 1.22 behavior` is fixed.
2. To avoid CSRF attack for OpenID endpoint, add a state check

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

2026-10-12 20:57:41 +00:00

access_token_scope_test.go

fix: validate "scope" for OAuth2, "state" for OpenID (#39642 )

2026-10-12 20:57:41 +00:00

access_token_scope.go

fix: validate "scope" for OAuth2, "state" for OpenID (#39642 )

2026-10-12 20:57:41 +00:00

access_token_test.go

feat(user): Personal access tokens can be regenerated (#38907 )

2026-08-17 18:17:16 +00:00

access_token.go

feat: Add audit logging (#38189 )