Go to file
M Hickford 191a74d622
Record OAuth client type at registration (#21316)
The OAuth spec [defines two types of
client](https://datatracker.ietf.org/doc/html/rfc6749#section-2.1),
confidential and public. Previously Gitea assumed all clients to be
confidential.

> OAuth defines two client types, based on their ability to authenticate
securely with the authorization server (i.e., ability to
>   maintain the confidentiality of their client credentials):
>
>   confidential
> Clients capable of maintaining the confidentiality of their
credentials (e.g., client implemented on a secure server with
> restricted access to the client credentials), or capable of secure
client authentication using other means.
>
>   **public
> Clients incapable of maintaining the confidentiality of their
credentials (e.g., clients executing on the device used by the resource
owner, such as an installed native application or a web browser-based
application), and incapable of secure client authentication via any
other means.**
>
> The client type designation is based on the authorization server's
definition of secure authentication and its acceptable exposure levels
of client credentials. The authorization server SHOULD NOT make
assumptions about the client type.

 https://datatracker.ietf.org/doc/html/rfc8252#section-8.4

> Authorization servers MUST record the client type in the client
registration details in order to identify and process requests
accordingly.

Require PKCE for public clients:
https://datatracker.ietf.org/doc/html/rfc8252#section-8.1

> Authorization servers SHOULD reject authorization requests from native
apps that don't use PKCE by returning an error message

Fixes #21299

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
2022-10-24 15:59:24 +08:00
.gitea Issue template form (#16349) 2021-09-15 20:33:13 +03:00
.github update discord invite (#19907) 2022-06-07 11:40:27 -04:00
assets Allow creation of OAuth2 applications for orgs (#18084) 2022-10-09 20:07:41 +08:00
build Simplify fmt-check (#21458) 2022-10-16 16:11:17 +08:00
cmd dump: Add option to skip index dirs (#21501) 2022-10-24 11:19:21 +08:00
contrib Add link to user profile in markdown mention only if user exists (#21533) 2022-10-23 01:15:52 +08:00
custom/conf Update comment about repository.DISABLED_REPO_UNITS in app.example.ini (#21343) 2022-10-05 20:38:30 +01:00
docker Fix the mode of custom dir to 0700 in docker-rootless (#20861) 2022-08-19 11:05:07 -04:00
docs Record OAuth client type at registration (#21316) 2022-10-24 15:59:24 +08:00
models Record OAuth client type at registration (#21316) 2022-10-24 15:59:24 +08:00
modules Record OAuth client type at registration (#21316) 2022-10-24 15:59:24 +08:00
options Record OAuth client type at registration (#21316) 2022-10-24 15:59:24 +08:00
public Update JS dependencies and eslint config (#21388) 2022-10-10 20:02:20 +08:00
routers Record OAuth client type at registration (#21316) 2022-10-24 15:59:24 +08:00
services Record OAuth client type at registration (#21316) 2022-10-24 15:59:24 +08:00
snap switch to node18 for snapcraft 2022-08-18 12:25:50 -04:00
templates Record OAuth client type at registration (#21316) 2022-10-24 15:59:24 +08:00
tests Record OAuth client type at registration (#21316) 2022-10-24 15:59:24 +08:00
tools Remove legacy +build: constraint (#19582) 2022-05-02 23:22:45 +08:00
web_src Expand "Go to File" button again, fix 'Add File' margin (#21543) 2022-10-24 02:23:04 +01:00
.air.toml Fix make watch for generated files (#20794) 2022-08-14 22:22:09 +01:00
.changelog.yml Changelog for v1.15.0-rc1 (#16422) 2021-07-15 11:47:57 -04:00
.drone.yml Fix Drone pushing commits with wrong author info (#21450) 2022-10-14 15:09:04 -04:00
.editorconfig Add markdownlint (#20512) 2022-07-28 09:22:47 +08:00
.eslintrc.yaml Remove vitest globals (#21505) 2022-10-19 14:50:19 +08:00
.gitattributes Hook go-licenses into tidy again (#21353) 2022-10-10 20:45:02 +02:00
.gitignore Add go licenses to licenses.txt (#21034) 2022-09-04 00:20:46 +02:00
.gitpod.yml Use recommended vscode configuration in gitpod environments (#21537) 2022-10-24 02:24:33 +01:00
.golangci.yml Simplify fmt-check (#21458) 2022-10-16 16:11:17 +08:00
.ignore Add some .ignore entries (#18296) 2022-01-16 17:26:15 +00:00
.lgtm refactor: ignore LGTM from author of pull request. (#3283) 2018-01-02 06:13:49 -06:00
.markdownlint.yaml Add markdownlint (#20512) 2022-07-28 09:22:47 +08:00
.npmrc Stop packaging node_modules in release tarballs (#15273) 2021-04-09 01:08:14 -04:00
.spectral.yaml Add spectral linter for Swagger (#20321) 2022-07-11 18:07:16 -05:00
.stylelintrc.yaml Move eslintrc/stylelintrc to non-deprecated extensions (#20110) 2022-06-24 14:09:53 +02:00
BSDmakefile Add BSDmakefile to prevent errors when make is called under FreeBSD (#4446) 2018-07-16 20:45:51 +02:00
build.go Remove legacy +build: constraint (#19582) 2022-05-02 23:22:45 +08:00
CHANGELOG.md 1.17.3 changelog 2022-10-15 22:03:59 -04:00
CONTRIBUTING.md Add wording about keeping PRs up-to-date in CONTRIBUTING.md (#21468) 2022-10-15 12:41:24 -04:00
DCO follow the advisor: add DCO and some improvements 2016-11-04 16:43:41 +08:00
Dockerfile Switch to building with go1.19 (#20695) 2022-08-07 12:25:03 -04:00
Dockerfile.rootless Switch to building with go1.19 (#20695) 2022-08-07 12:25:03 -04:00
go.mod Update binding to fix bugs (#21556) 2022-10-23 13:50:48 +03:00
go.sum Update binding to fix bugs (#21556) 2022-10-23 13:50:48 +03:00
LICENSE Fix typo 2016-11-08 08:42:05 +01:00
main.go Fix typo overrided -> overridden (#20687) 2022-08-06 20:54:26 -04:00
MAINTAINERS Add yardenshoham to maintainers (#21566) 2022-10-23 12:09:21 -04:00
Makefile Remove unnecessary misspell ignore pattern (#21475) 2022-10-18 12:52:25 -04:00
package-lock.json Switch from jest to vitest (#21444) 2022-10-14 21:36:16 +08:00
package.json Switch from jest to vitest (#21444) 2022-10-14 21:36:16 +08:00
playwright.config.js Update JS dependencies and eslint config (#21388) 2022-10-10 20:02:20 +08:00
README_ZH.md Refactor Gitpod configuration to improve quick spin up of automated dev environments (#21411) 2022-10-12 12:17:04 -04:00
README.md Add cynkra bronze sponsor (#21325) 2022-10-13 21:44:04 -04:00
SECURITY.md Add markdownlint (#20512) 2022-07-28 09:22:47 +08:00
vitest.config.js Remove vitest globals (#21505) 2022-10-19 14:50:19 +08:00
webpack.config.js Update JS dependencies and eslint config (#21388) 2022-10-10 20:02:20 +08:00

Gitea

Gitea - Git with a cup of tea

Contribute with Gitpod

View this document in Chinese

Purpose

The goal of this project is to make the easiest, fastest, and most painless way of setting up a self-hosted Git service.

As Gitea is written in Go, it works across all the platforms and architectures that are supported by Go, including Linux, macOS, and Windows on x86, amd64, ARM and PowerPC architectures. You can try it out using the online demo. This project has been forked from Gogs since November of 2016, but a lot has changed.

Building

From the root of the source tree, run:

TAGS="bindata" make build

or if SQLite support is required:

TAGS="bindata sqlite sqlite_unlock_notify" make build

The build target is split into two sub-targets:

  • make backend which requires Go Stable, required version is defined in go.mod.
  • make frontend which requires Node.js LTS or greater and Internet connectivity to download npm dependencies.

When building from the official source tarballs which include pre-built frontend files, the frontend target will not be triggered, making it possible to build without Node.js and Internet connectivity.

Parallelism (make -j <num>) is not supported.

More info: https://docs.gitea.io/en-us/install-from-source/

Using

./gitea web

NOTE: If you're interested in using our APIs, we have experimental support with documentation.

Contributing

Expected workflow is: Fork -> Patch -> Push -> Pull Request

NOTES:

  1. YOU MUST READ THE CONTRIBUTORS GUIDE BEFORE STARTING TO WORK ON A PULL REQUEST.
  2. If you have found a vulnerability in the project, please write privately to security@gitea.io. Thanks!

Translating

Translations are done through Crowdin. If you want to translate to a new language ask one of the managers in the Crowdin project to add a new language there.

You can also just create an issue for adding a language or ask on discord on the #translation channel. If you need context or find some translation issues, you can leave a comment on the string or ask on Discord. For general translation questions there is a section in the docs. Currently a bit empty but we hope to fill it as questions pop up.

https://docs.gitea.io/en-us/translation-guidelines/

Crowdin

Further information

For more information and instructions about how to install Gitea, please look at our documentation. If you have questions that are not covered by the documentation, you can get in contact with us on our Discord server or create a post in the discourse forum.

We maintain a list of Gitea-related projects at gitea/awesome-gitea.

The Hugo-based documentation theme is hosted at gitea/theme.

The official Gitea CLI is developed at gitea/tea.

Authors

Backers

Thank you to all our backers! 🙏 [Become a backer]

Sponsors

Support this project by becoming a sponsor. Your logo will show up here with a link to your website. [Become a sponsor]

FAQ

How do you pronounce Gitea?

Gitea is pronounced /ɡɪti:/ as in "gi-tea" with a hard g.

Why is this not hosted on a Gitea instance?

We're working on it.

License

This project is licensed under the MIT License. See the LICENSE file for the full license text.

Screenshots

Looking for an overview of the interface? Check it out!

Dashboard User Profile Global Issues
Branches Web Editor Activity
New Migration Migrating Pull Request View
Pull Request Dark Diff Review Dark Diff Dark