Git with a cup of tea, painless self-hosted git service Mirror for internal git.with.parts use https://git.with.parts

You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Shivaram Lingamneni 2f1cb1d289 fix OIDC introspection authentication (#31632) ... See discussion on #31561 for some background. The introspect endpoint was using the OIDC token itself for authentication. This fixes it to use basic authentication with the client ID and secret instead: * Applications with a valid client ID and secret should be able to successfully introspect an invalid token, receiving a 200 response with JSON data that indicates the token is invalid * Requests with an invalid client ID and secret should not be able to introspect, even if the token itself is valid Unlike #31561 (which just future-proofed the current behavior against future changes to `DISABLE_QUERY_AUTH_TOKEN`), this is a potential compatibility break (some introspection requests without valid client IDs that would previously succeed will now fail). Affected deployments must begin sending a valid HTTP basic authentication header with their introspection requests, with the username set to a valid client ID and the password set to the corresponding client secret.		4 months ago
..
api	add skip secondary authorization option for public oauth2 clients (#31454)	4 months ago
common	Refactor route path normalization (#31381)	5 months ago
install	Refactor names (#31405)	5 months ago
private	Allow force push to protected branches (#28086)	4 months ago
utils	Refactor external URL detection (#29973)	8 months ago
web	fix OIDC introspection authentication (#31632)	4 months ago
init.go	Refactor names (#31405)	5 months ago