forgejo/modules/context
KN4CK3R c6c829fe3f
Enhanced auth token / remember me (#27606)
Closes #27455

> The mechanism responsible for long-term authentication (the 'remember
me' cookie) uses a weak construction technique. It will hash the user's
hashed password and the rands value; it will then call the secure cookie
code, which will encrypt the user's name with the computed hash. If one
were able to dump the database, they could extract those two values to
rebuild that cookie and impersonate a user. That vulnerability exists
from the date the dump was obtained until a user changed their password.
> 
> To fix this security issue, the cookie could be created and verified
using a different technique such as the one explained at
https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies.

The PR removes the now obsolete setting `COOKIE_USERNAME`.
2023-10-14 00:56:41 +00:00
..
access_log.go Replace interface{} with any (#25686) 2023-07-04 18:36:08 +00:00
api.go Updates to the API for archived repos (#27149) 2023-09-21 23:43:29 +00:00
api_org.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
api_test.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
base.go Introduce ctx.PathParamRaw to avoid incorrect unescaping (#26392) 2023-08-09 14:57:45 +08:00
captcha.go Replace interface{} with any (#25686) 2023-07-04 18:36:08 +00:00
context.go Make web context initialize correctly for different cases (#26726) 2023-08-25 19:07:42 +08:00
context_cookie.go Enhanced auth token / remember me (#27606) 2023-10-14 00:56:41 +00:00
context_model.go Improve Gitea's web context, decouple "issue template" code into service package (#24590) 2023-05-09 01:30:14 +02:00
context_request.go Decouple the different contexts from each other (#24786) 2023-05-21 09:50:53 +08:00
context_response.go Start using template context function (#26254) 2023-08-08 01:22:47 +00:00
context_template.go Start using template context function (#26254) 2023-08-08 01:22:47 +00:00
context_test.go Use standard HTTP library to serve files (#24693) 2023-05-13 16:04:57 +02:00
csrf.go Refactor cookie (#24107) 2023-04-13 15:45:33 -04:00
org.go Even more db.DefaultContext refactor (#27352) 2023-10-03 10:30:41 +00:00
package.go Even more db.DefaultContext refactor (#27352) 2023-10-03 10:30:41 +00:00
pagination.go Replace interface{} with any (#25686) 2023-07-04 18:36:08 +00:00
permission.go Add context parameter to some database functions (#26055) 2023-07-22 22:14:27 +08:00
private.go Replace interface{} with any (#25686) 2023-07-04 18:36:08 +00:00
repo.go Penultimate round of db.DefaultContext refactor (#27414) 2023-10-11 04:24:07 +00:00
response.go Refactor web package and context package (#25298) 2023-06-18 09:59:09 +02:00
utils.go Avoid double-unescaping of form value (#26853) 2023-09-01 12:01:36 +00:00
xsrf.go Update gitea-vet to check FSFE REUSE (#22004) 2022-12-02 22:14:57 +08:00
xsrf_test.go Update gitea-vet to check FSFE REUSE (#22004) 2022-12-02 22:14:57 +08:00