Remove ReverseProxy authentication from the API (#22219) #22252
Conversation
Since we changed the /api/v1/ routes to disallow session authentication we also removed their reliance on CSRF. However, we left the ReverseProxy authentication here - but this means that POSTs to the API are no longer protected by CSRF. Now, ReverseProxy authentication is a kind of session authentication, and is therefore inconsistent with the removal of session from the API. This PR proposes that we simply remove the ReverseProxy authentication from the API and therefore users of the API must explicitly use tokens or basic authentication. Replace go-gitea#22077 Close go-gitea#22221 Close go-gitea#22077 Signed-off-by: Andrew Thornton <art27@cantab.net>
lunny
added
the
topic/security
GiteaBot
added
the
lgtm/need 1
There was a problem hiding this comment.
Should we really backport that to 1.17?
I think this is too breaking to merge into 1.17.
Even if the session removal might have been already done in 1.17 (which I'm unsure of), I don't think it is a good idea to backport a breaking change into a minor version increase.
With 1.18, we have the benefit that 1.18.0 hasn't been released yet, so it at least should not really affect many people, and people rather expect breaking changes between releases.
But as we want to be semver compatible, I strongly discourage backporting a breaking change for a released major version
|
|
|
I approved it as the security fix but it may be ok to only backport it to 1.18 because 1.17 should be obsolete in the next days. |
GiteaBot
added
lgtm/done
backport #22219
Since we changed the /api/v1/ routes to disallow session authentication we also removed their reliance on CSRF. However, we left the ReverseProxy authentication here - but this means that POSTs to the API are no longer protected by CSRF.
Now, ReverseProxy authentication is a kind of session authentication, and is therefore inconsistent with the removal of session from the API.
This PR proposes that we simply remove the ReverseProxy authentication from the API and therefore users of the API must explicitly use tokens or basic authentication.
Replace #22077
Close #22221
Close #22077
Signed-off-by: Andrew Thornton art27@cantab.net