mirror of
https://codeberg.org/forgejo/forgejo.git
synced 2026-05-12 22:10:25 +00:00
7fc236c589
Allow JWTs that are generated by Forgejo Actions to be validated within Forgejo in-memory. Without any special support for this internal access situation, these problems would occur: 1. Forgejo would need to make an HTTP request to itself to get the valid public key for the JWT, in order to validate its signature. This is a waste of resources, and introduces a self-DoS risk. 2. Forgejo would need to be available via TLS in order for Actions to make service calls to Forgejo with that JWT, due to the TLS requirement for public key fetching. This would be a blocker for writing end-to-end tests for Forgejo, but also would affect users who do not host Forgejo with TLS. 3. Authorized Integrations would need to be saved with the `issuer` URL of Forgejo. If Forgejo's own `setting.AppURL` changed, all the persisted records in the database would become incorrect. ## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Tests for Go changes - I added test coverage for Go changes... - [x] in their respective `*_test.go` for unit tests. - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server. - I ran... - [x] `make pr-go` before pushing ### Documentation - [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - [x] I did not document these changes and I do not expect someone else to do it. ### Release notes - [ ] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [x] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12364 Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org> |
||
|---|---|---|
| .. | ||
| forgejo | ||
| actions.go | ||
| admin.go | ||
| admin_auth.go | ||
| admin_auth_ldap.go | ||
| admin_auth_ldap_test.go | ||
| admin_auth_oauth.go | ||
| admin_auth_oauth_test.go | ||
| admin_auth_pam.go | ||
| admin_auth_pam_test.go | ||
| admin_auth_smtp.go | ||
| admin_regenerate.go | ||
| admin_user.go | ||
| admin_user_change_password.go | ||
| admin_user_create.go | ||
| admin_user_delete.go | ||
| admin_user_generate_access_token.go | ||
| admin_user_generate_authorized_integration.go | ||
| admin_user_list.go | ||
| admin_user_must_change_password.go | ||
| admin_user_reset_mfa.go | ||
| cert.go | ||
| cmd.go | ||
| cmd_test.go | ||
| doctor.go | ||
| doctor_convert.go | ||
| doctor_test.go | ||
| dump.go | ||
| dump_repo.go | ||
| dump_test.go | ||
| embedded.go | ||
| generate.go | ||
| hook.go | ||
| hook_test.go | ||
| keys.go | ||
| mailer.go | ||
| main.go | ||
| main_test.go | ||
| manager.go | ||
| manager_logging.go | ||
| migrate.go | ||
| migrate_storage.go | ||
| migrate_storage_test.go | ||
| restore_repo.go | ||
| serv.go | ||
| web.go | ||
| web_acme.go | ||
| web_graceful.go | ||
| web_https.go | ||