Skip to content

Conversation

hickford
Copy link
Contributor

@hickford hickford commented Oct 12, 2022

According to the OAuth spec https://datatracker.ietf.org/doc/html/rfc6749#section-6 when "Refreshing an Access Token"

The authorization server MUST ... require client authentication for confidential clients

Fixes #21418

@hickford hickford force-pushed the oauth-authenticate-refresh branch 2 times, most recently from 6b5edf7 to b18216c Compare October 12, 2022 20:20
@hickford hickford marked this pull request as ready for review October 12, 2022 20:20
@GiteaBot GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Oct 14, 2022
hickford and others added 2 commits October 21, 2022 16:56
@hickford hickford force-pushed the oauth-authenticate-refresh branch from d1a6342 to 4d77d33 Compare October 21, 2022 14:57
@hickford hickford requested a review from Gusted October 21, 2022 14:57
@Gusted Gusted added this to the 1.18.0 milestone Oct 22, 2022
@Gusted Gusted added the type/enhancement An improvement of existing functionality label Oct 22, 2022
@GiteaBot GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels Oct 22, 2022
@Gusted Gusted added lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. backport/v1.17 and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Oct 22, 2022
@GiteaBot GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels Oct 22, 2022
@lunny
Copy link
Member

lunny commented Oct 23, 2022

make L-G-T-M work

@lunny lunny merged commit afebbf2 into go-gitea:main Oct 23, 2022
@lunny
Copy link
Member

lunny commented Oct 24, 2022

Please send backport.

zjjhot added a commit to zjjhot/gitea that referenced this pull request Oct 24, 2022
* upstream/main:
  adapt README_{Country}.md stype name in localizedExtensions (go-gitea#21486)
  dump: Add option to skip index dirs (go-gitea#21501)
  Use recommended vscode configuration in gitpod environments (go-gitea#21537)
  Expand "Go to File" button again, fix 'Add File' margin (go-gitea#21543)
  Add yardenshoham to maintainers (go-gitea#21566)
  Refactor git command arguments and make all arguments to be safe to be used (go-gitea#21535)
  Update binding to fix bugs (go-gitea#21556)
  Link mentioned user in markdown only if they are visible to viewer (go-gitea#21554)
  Require authentication for OAuth token refresh (go-gitea#21421)
  CSS color enhancements (go-gitea#21534)
  Allow package version sorting (go-gitea#21453)
  Add link to user profile in markdown mention only if user exists (go-gitea#21533)
  Update milestone counters when issue is deleted (go-gitea#21459)
  Prevent Authorization header for presigned LFS urls (go-gitea#21531)
  Remove deleted repos from searchresult (go-gitea#21512)
  Remove unnecessary debug log (go-gitea#21536)
  Added check for disabled Packages (go-gitea#21540)
  Decouple HookTask from Repository (go-gitea#17940)
  Add color previews in markdown (go-gitea#21474)
  Fix generating compare link (go-gitea#21519)
@go-gitea go-gitea locked and limited conversation to collaborators May 3, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. type/enhancement An improvement of existing functionality
Projects
None yet
Development

Successfully merging this pull request may close these issues.

OAuth refresh handler should require client authentication
4 participants