Enable X-Gitea-OTP header for git operations #12399

GiteaMirror commented

@KN4CK3R commented on GitHub (Jan 28, 2024):

That sounds really exhausting because the OTP always needs to be refreshed. Why not use a PAT instead of the normal password?

@KN4CK3R commented on GitHub (Jan 28, 2024): That sounds really exhausting because the OTP always needs to be refreshed. Why not use a PAT instead of the normal password?

GiteaMirror commented

@Kwonunn commented on GitHub (Jan 28, 2024):

This is just for use in cases where I'm fetching a project once onto a server I don't want to set up SSH on.

Using tokens for this would either require making a fresh token every time which is annoying, or having one to always use which is a security hole.

@Kwonunn commented on GitHub (Jan 28, 2024): This is just for use in cases where I'm fetching a project once onto a server I don't want to set up SSH on. Using tokens for this would either require making a fresh token every time which is annoying, or having one to always use which is a security hole.

GiteaMirror commented

@techknowlogick commented on GitHub (Jan 28, 2024):

This is quite interesting. On one hand user/pass auth for api/git operations are being depreciated, but it does give the idea of otp with scoped tokens 🤔

@techknowlogick commented on GitHub (Jan 28, 2024): This is quite interesting. On one hand user/pass auth for api/git operations are being depreciated, but it does give the idea of otp with scoped tokens 🤔

GiteaMirror commented

@Kwonunn commented on GitHub (Jan 28, 2024):

Is Gitea planning to deprecate http entirely for git operations?

@Kwonunn commented on GitHub (Jan 28, 2024): Is Gitea planning to deprecate http entirely for git operations?

GiteaMirror commented

@KN4CK3R commented on GitHub (Jan 28, 2024):

No, only the combination with username and password.

@KN4CK3R commented on GitHub (Jan 28, 2024): No, only the combination with username and password.

GiteaMirror commented

@Kwonunn commented on GitHub (Jan 28, 2024):

Why, if I may ask? I know GitHub has stopped allowing it but I'm not quite sure why.

@Kwonunn commented on GitHub (Jan 28, 2024): Why, if I may ask? I know GitHub has stopped allowing it but I'm not quite sure why.

GiteaMirror commented

@KN4CK3R commented on GitHub (Jan 28, 2024):

Because the username/password combination should be used in less places in favor of configurable tokens.

@KN4CK3R commented on GitHub (Jan 28, 2024): Because the username/password combination should be used in less places in favor of configurable tokens.

GiteaMirror commented

@Kwonunn commented on GitHub (Jan 28, 2024):

I see. Then, perhaps another method is more appropriate.

Maybe we could add a quick token button in this menu

which would generate a temporary personal access token scoped specifically to that repository and with read-only access, which you could use once to clone the repository somewhere?

@Kwonunn commented on GitHub (Jan 28, 2024): I see. Then, perhaps another method is more appropriate. Maybe we could add a quick token button in this menu ![image](https://github.com/go-gitea/gitea/assets/39026963/570705a9-4a12-409a-b9dd-cd9fad6b8528) which would generate a temporary personal access token scoped specifically to that repository and with read-only access, which you could use once to clone the repository somewhere?

GiteaMirror commented

@JakobDev commented on GitHub (Jan 29, 2024):

No, only the combination with username and password.

Why?

@JakobDev commented on GitHub (Jan 29, 2024): > No, only the combination with username and password. Why?

GiteaMirror commented

https://github.com/go-gitea/gitea/issues/28968#issuecomment-1913668160
https://github.blog/2020-12-15-token-authentication-requirements-for-git-operations/#background

@KN4CK3R commented on GitHub (Jan 29, 2024):

No, only the combination with username and password.

Why?

@KN4CK3R commented on GitHub (Jan 29, 2024): > > No, only the combination with username and password. > > Why? https://github.com/go-gitea/gitea/issues/28968#issuecomment-1913668160 https://github.blog/2020-12-15-token-authentication-requirements-for-git-operations/#background

GiteaMirror commented

@Kwonunn commented on GitHub (Jan 29, 2024):

I see. Then, perhaps another method is more appropriate.

Maybe we could add a quick token button in this menu which would generate a temporary personal access token scoped specifically to that repository and with read-only access, which you could use once to clone the repository somewhere?

Should I make a new feature request for this new idea and just leave the http OTP thing?

@Kwonunn commented on GitHub (Jan 29, 2024): > I see. Then, perhaps another method is more appropriate. > > Maybe we could add a quick token button in this menu ![image](https://private-user-images.githubusercontent.com/39026963/300282460-570705a9-4a12-409a-b9dd-cd9fad6b8528.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MDY1Mzg2NTYsIm5iZiI6MTcwNjUzODM1NiwicGF0aCI6Ii8zOTAyNjk2My8zMDAyODI0NjAtNTcwNzA1YTktNGExMi00MDlhLWI5ZGQtY2Q5ZmFkNmI4NTI4LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDAxMjklMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwMTI5VDE0MjU1NlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWY2NGE2YjQ1OGU2YjQxMTQ5OTkzOWMzMWE1OWI4YzkzYThlZWE5Y2QxZjg1YmRhMmZjODA2ZTU3YjgzNTZmMWImWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.bvSZnHiSeob3TXqyKtw4-AEcnagzLLW6LKZgru6tTUg) which would generate a temporary personal access token scoped specifically to that repository and with read-only access, which you could use once to clone the repository somewhere? Should I make a new feature request for this new idea and just leave the http OTP thing?

GiteaMirror commented