SignIn form disabled when reverse proxy auth is enabled #18601
Conversation
SignIn form should not be enabled when users are authenticated with reverse proxy. Author-Change-Id: IB#1115398
GiteaBot
added
the
lgtm/need 2
Co-authored-by: silverwind <me@silverwind.io>
|
This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 months. Thank you for your contributions. |
lunny
added
the
issue/confirmed
Disabled registration notification e-mail in reverse proxy mode to avoid spamming with invalid instructions (such accounts are created by admin in exteral systems not during self registration and no gitea passwords are used for auth). Related: go-gitea#18601 Author-Change-Id: IB#1122610
| @@ -240,6 +240,9 @@ func NewFuncMap() []template.FuncMap { | |||
| "DisableImportLocal": func() bool { | |||
| return !setting.ImportLocalPaths | |||
| }, | |||
| "DisableReverseProxyAuth": func() bool { | |||
There was a problem hiding this comment.
Maybe it's better to use EnableReverseProxyAuth?
|
|
|
As a personal/private usage, these changes are good. As a general feature for all users, I am not sure whether these changes are complete. For example, there are other handlers besides "login": "openid", "sign_up", "oauth2", etc. To make it a general feature for all users (avoid any misuse or risk), I think there should be a whole design/plan for the Account System first. Just my personal opinion, correct me if I was wrong. |
Disabling unused auth stuff is good for professional usage also IHMO.
Gitea should implement pluging-based auth system and plugin-based authz system IHMO and not focus on specific auth soluition (like tokens/passwords, etc.). Separate auth/authz plugin config for front and API probably if separate set of APIs is necessary. Not easy to implement probably so consider spliiting this idea to separate thread to discuss and implement. This mod would be obsolete if signing screen was part of "password auth plugin". |
|
It should have been improved by Allow to disable the password-based login (sign-in) form #32687 (not exactly the same but I think it should work for your case, if not, feel free to reopen) |
SignIn form should not be enabled when users are authenticated
with reverse proxy.
Author-Change-Id: IB#1115398