forgejo-federation/docs
M Hickford 191a74d622
Record OAuth client type at registration (#21316)
The OAuth spec [defines two types of
client](https://datatracker.ietf.org/doc/html/rfc6749#section-2.1),
confidential and public. Previously Gitea assumed all clients to be
confidential.

> OAuth defines two client types, based on their ability to authenticate
securely with the authorization server (i.e., ability to
>   maintain the confidentiality of their client credentials):
>
>   confidential
> Clients capable of maintaining the confidentiality of their
credentials (e.g., client implemented on a secure server with
> restricted access to the client credentials), or capable of secure
client authentication using other means.
>
>   **public
> Clients incapable of maintaining the confidentiality of their
credentials (e.g., clients executing on the device used by the resource
owner, such as an installed native application or a web browser-based
application), and incapable of secure client authentication via any
other means.**
>
> The client type designation is based on the authorization server's
definition of secure authentication and its acceptable exposure levels
of client credentials. The authorization server SHOULD NOT make
assumptions about the client type.

 https://datatracker.ietf.org/doc/html/rfc8252#section-8.4

> Authorization servers MUST record the client type in the client
registration details in order to identify and process requests
accordingly.

Require PKCE for public clients:
https://datatracker.ietf.org/doc/html/rfc8252#section-8.1

> Authorization servers SHOULD reject authorization requests from native
apps that don't use PKCE by returning an error message

Fixes #21299

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
2022-10-24 15:59:24 +08:00
..
assets/js Add new JS linter rules (#17699) 2021-11-22 16:19:01 +08:00
content Record OAuth client type at registration (#21316) 2022-10-24 15:59:24 +08:00
layouts docs: move search input to navbar (#20551) 2022-08-08 15:27:04 +08:00
scripts Fix building of docs with latest hugo version (#3856) 2018-04-28 23:46:05 +03:00
static inline gitpod image (#21494) 2022-10-18 09:55:57 +08:00
.gitignore Support Issue forms and PR forms (#20987) 2022-09-02 15:58:49 +08:00
config.yaml update current stable version 2022-10-15 22:04:25 -04:00
LICENSE Import docs into main repository (#2874) 2017-11-26 23:44:32 +02:00
Makefile follow redirect when fetching theme archive (#15986) 2021-05-26 18:03:39 -04:00
README.md Update to docs README (#6221) 2019-03-01 15:39:30 -05:00
README_ZH.md update discord link (#10455) 2020-02-25 12:36:45 -05:00

Gitea: Docs

Join the chat at https://img.shields.io/discord/322538954119184384.svg

Hosting

These pages are hosted using netlifycms and get automatically updated on every push to the master branch.

Install

These pages use the Hugo static site generator. If you are planning to contribute you'll want to download and install Hugo on your local machine.

The installation of Hugo is out of the scope of this document, so please take the official install instructions to get Hugo up and running.

Development

To generate the website and serve it on localhost:1313 just execute this command and stop it with Ctrl+C:

make server

When you are done with your changes just create a pull request, after merging the pull request the website will be updated automatically.

Contributing

Fork -> Patch -> Push -> Pull Request

Authors

License

This project is under the Apache-2.0 License. See the LICENSE file for the full license text.

Copyright (c) 2016 The Gitea Authors <https://gitea.io>