lywsvip/server
1
0
Fork 0
mirror of https://github.com/gotify/server.git synced 2026-09-06 07:50:35 +08:00
Code Issues Packages Projects Releases Wiki Activity
924 Commits 21 Branches 71 Tags
bcrypt-errors
Commit Graph

34 Commits

Author SHA1 Message Date
Jannis Mattheis
d832b1a41d fix: prevent csrf for cookie requests 
Prevously, the token was passed as X-Gotify-Key by the UI, so there was
no csrf because no cookie was added by the browser to the request.

The cookie is saved by SameSite=strict, this provides some protection
against csrf. But an subdomain takeover could still allow for csrf. E.g.
evil.gotify.net could send authenticated requests to gotify.net.

This uses the go builtin cross origin protection, listed on the owasp
page: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#built-in-or-existing-csrf-implementations
 2026-07-17 14:09:48 +02:00
饺子w (Yumechi)
ad977d3d9c feat: EdDSA token for database leakage/index mitigation (#971) 
* feat: EdDSA token for database leakage/index mitigation

* [skip ci]: remove token from api output

* fix: e2e tests

* fixup! fix: e2e tests

* doc: document tokens are now optional fields for app and aclient

* fixup(doc): swagger version again

* address review comments

* address review comments
 2026-06-28 14:58:20 +00:00
Jannis Mattheis
be509766d8 feat: allow sending message with client/basic path 2026-05-25 18:32:05 +02:00
Jannis Mattheis
67d87f1b50 feat: clean up expired devices 2026-05-18 17:16:08 +02:00
Jannis Mattheis
e9ca916396 fixup! fix: enforce elevated authentication 2026-04-22 20:10:43 +02:00
Jannis Mattheis
3c5115812e fix: use auth functions instead of booleans 2026-04-22 20:10:43 +02:00
Jannis Mattheis
a8744482c6 fix: enforce elevated authentication 2026-04-19 19:24:18 +02:00
Jannis Mattheis
681b9e2d90 fix: unify authentication context 
This uses a single struct for the authentication. This prevents further
re-requesting of the already requested data.
 2026-04-19 19:22:03 +02:00
Jannis Mattheis
57878e0574 fix: make secure cookie configurable 2026-04-11 18:53:48 +02:00
Jannis Mattheis
50d0572584 feat: implement /auth/local/{login,logout} 2026-04-11 18:53:48 +02:00
Jannis Mattheis
387da44883 fix: read token from cookie 2026-04-11 18:53:48 +02:00
Jannis Mattheis
39357c67d9 fix: simplify authentication handling 2026-04-11 18:53:48 +02:00
eternal-flame-AD
7bf80ee6f1 Add last used to client & application 2023-08-06 12:30:22 +02:00
mateuscelio
0fb584d7f7 Update docs 2022-12-03 10:45:07 +01:00
mateuscelio
70e1fd1863 Add authorization bearer token auth method 2022-12-03 10:45:07 +01:00
pigpig
c172590b92 Add registration 
Can be enabled via the registration config flag. (disabled per default)

Fixes gotify/server#395

Co-authored-by: pigpig <pigpig@pig.pig>
Co-authored-by: Karmanyaah Malhotra <32671690+karmanyaahm@users.noreply.github.com>
Co-authored-by: Jannis Mattheis <contact@jmattheis.de>
 2021-08-04 19:39:43 +02:00
Jannis Mattheis
3454dcd602 Use golangci-lint 2020-11-01 10:47:02 +01:00
Jannis Mattheis
7b90b8a8f5 Use v2 in package path 2020-05-08 10:43:17 +02:00
饺子w
67493c643e Return 500 server error on database failures (#191) 2019-05-25 08:37:24 +02:00
eternal-flame-AD
e5b24f4c92 Add plugin feature 
Fixed database migration
Added a plugin system based on the go plugin package
 2019-02-09 12:52:01 +01:00
Jannis Mattheis
0f2e7cf5e2 Use gofmt -s 2018-03-25 19:33:29 +02:00
Jannis Mattheis
203791c63b Move password into own package to prevent package cycle 2018-03-25 19:33:29 +02:00
Jannis Mattheis
433a83823b Use *ByToken methods in auth 2018-03-11 17:58:44 +01:00
Jannis Mattheis
6a5357f9b3 Format & reorder imports 2018-02-18 12:56:42 +01:00
Jannis Mattheis
a5acb20d0e Use custom header for authentication 2018-02-18 12:56:42 +01:00
Jannis Mattheis
1e7e1a71f7 Rename to gotify 2018-02-12 16:48:01 +01:00
Jannis Mattheis
08dbacd71b Adjust authentication to also send 403 2018-02-11 14:33:59 +01:00
Jannis Mattheis
4e3d00ea98 Reorder imports 2018-02-08 19:52:58 +01:00
Jannis Mattheis
8e8705c6e5 Add tokenkey to the gin context 2018-02-01 18:49:12 +01:00
Jannis Mattheis
fadf989158 Rename auth.Database methods 2018-01-28 15:56:28 +01:00
Jannis Mattheis
6770e6b654 Enable golint and fix golint-errors like adding documentation 2018-01-28 15:56:28 +01:00
Jannis Mattheis
aa66e9792b Add auth util for saving the user in the ctx 2018-01-27 20:31:56 +01:00
Jannis Mattheis
8a989dc29a Remove token and add app and client token & Adjust tests 2018-01-27 20:31:56 +01:00
Jannis Mattheis
662e1f4fb5 Add authentication middleware 2018-01-23 18:03:51 +01:00