Denys Konovalov 402e030b6b Allow for PKCE flow without client secret + add docs (#25033) ...

The PKCE flow according to [RFC
7636](https://datatracker.ietf.org/doc/html/rfc7636) allows for secure
authorization without the requirement to provide a client secret for the
OAuth app.

It is implemented in Gitea since #5378 (v1.8.0), however without being
able to omit client secret.
Since #21316 Gitea supports setting client type at OAuth app
registration.

As public clients are already forced to use PKCE since #21316, in this
PR the client secret check is being skipped if a public client is
detected. As Gitea seems to implement PKCE authorization correctly
according to the spec, this would allow for PKCE flow without providing
a client secret.

Also add some docs for it, please check language as I'm not a native
English speaker.

Closes #17107
Closes #25047

2023-06-03 05:59:28 +02:00

doc

Allow for PKCE flow without client secret + add docs (#25033)

2023-06-03 05:59:28 +02:00

page

Fix markdown link to awesome gitea (#25009)

2023-05-30 13:10:51 -05:00

S

Description

No description provided

Apache-2.0

9.6 MiB

Languages

TypeScript 42.4%

MDX 30.9%

Astro 8.1%

JavaScript 6.4%

Shell 6%

Other 6.2%