forgejo/routers/web/auth
Archer 1b088fade6
Prevent automatic OAuth grants for public clients (#30790)
This commit forces the resource owner (user) to always approve OAuth 2.0
authorization requests if the client is public (e.g. native
applications).

As detailed in [RFC 6749 Section 10.2](https://www.rfc-editor.org/rfc/rfc6749.html#section-10.2),

> The authorization server SHOULD NOT process repeated authorization
requests automatically (without active resource owner interaction)
without authenticating the client or relying on other measures to ensure
that the repeated request comes from the original client and not an
impersonator.

With the implementation prior to this patch, attackers with access to
the redirect URI (e.g., the loopback interface for
`git-credential-oauth`) can get access to the user account without any
user interaction if they can redirect the user to the
`/login/oauth/authorize` endpoint somehow (e.g., with `xdg-open` on
Linux).

Fixes #25061.

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
(cherry picked from commit 5c542ca94caa3587329167cfe9e949357ca15cf1)
2024-05-05 12:15:40 +01:00
..
2fa.go Move context from modules to services (#29440) 2024-03-06 12:10:43 +08:00
auth.go [PORT] drop utils.IsExternalURL (and expand IsRiskyRedirectURL tests) (#3167) 2024-04-15 13:03:08 +00:00
auth_test.go Make "/user/login" page redirect if the current user has signed in (#29583) 2024-03-11 23:36:58 +07:00
linkaccount.go Move context from modules to services (#29440) 2024-03-06 12:10:43 +08:00
main_test.go
oauth.go Prevent automatic OAuth grants for public clients (#30790) 2024-05-05 12:15:40 +01:00
oauth_test.go feat: implement PKCE when acting as oauth2 client (for user login) 2024-04-29 11:20:26 +02:00
openid.go Move context from modules to services (#29440) 2024-03-06 12:10:43 +08:00
password.go Clean up log messages (#30313) 2024-04-15 20:01:35 +02:00
webauthn.go Move context from modules to services (#29440) 2024-03-06 12:10:43 +08:00