[PR #2184] [MERGED] Only allow token authentication with 2FA enabled #16276

New Issue

GiteaMirror · 2025-11-02T12:06:32-06:00

GiteaMirror commented

2025-11-02 12:06:32 -06:00

📋 Pull Request Information

Original PR: https://github.com/go-gitea/gitea/pull/2184
Author: @moritzheiber
Created: 7/19/2017
Status: ✅ Merged
Merged: 7/26/2017
Merged by: @lunny

Base: master ← Head: master

📝 Commits (6)

7673b8b Don't allow for plain username/password authentication when 2FA is enabled
02a101e Removed debugging statement
6ce636f Don't assume a token belongs to a given user, handle two-factor errors properly
e6484d5 Simplified user/token matching, refactored error handling for two-factor authentication
f6857ec Change authentication response to avoid bruteforcing
9a14c6d Add TODO item as a comment for changing the response for security purposes

📊 Changes

1 file changed (+32 additions, -6 deletions)

View changed files

📝 routers/repo/http.go (+32 -6)

📄 Description

Fixes #1394

Previously, when a user had 2FA enabled they were still able to authenticate via HTTP(S) using their regular username and password. This PR makes token authentication mandatory for accounts with 2FA enabled.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/go-gitea/gitea/pull/2184 **Author:** [@moritzheiber](https://github.com/moritzheiber) **Created:** 7/19/2017 **Status:** ✅ Merged **Merged:** 7/26/2017 **Merged by:** [@lunny](https://github.com/lunny) **Base:** `master` ← **Head:** `master` --- ### 📝 Commits (6) - [`7673b8b`](https://github.com/go-gitea/gitea/commit/7673b8bf48bfe89a802245df920efe84262cf66a) Don't allow for plain username/password authentication when 2FA is enabled - [`02a101e`](https://github.com/go-gitea/gitea/commit/02a101e6238607824229265641d30b708c61455f) Removed debugging statement - [`6ce636f`](https://github.com/go-gitea/gitea/commit/6ce636f259d22397c146beee1124a8d1168b84f0) Don't assume a token belongs to a given user, handle two-factor errors properly - [`e6484d5`](https://github.com/go-gitea/gitea/commit/e6484d57e769635ee34fdd6f165ec71527c67ef0) Simplified user/token matching, refactored error handling for two-factor authentication - [`f6857ec`](https://github.com/go-gitea/gitea/commit/f6857ecbc55a8c4cfac02e526f30ae35d9838775) Change authentication response to avoid bruteforcing - [`9a14c6d`](https://github.com/go-gitea/gitea/commit/9a14c6dc937b9b556ca9d668a50ebf18a95681f1) Add TODO item as a comment for changing the response for security purposes ### 📊 Changes **1 file changed** (+32 additions, -6 deletions) <details> <summary>View changed files</summary> 📝 `routers/repo/http.go` (+32 -6) </details> ### 📄 Description Fixes #1394 Previously, when a user had 2FA enabled they were still able to authenticate via HTTP(S) using their regular username and password. This PR makes token authentication mandatory for accounts with 2FA enabled. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2025-11-02 12:06:32 -06:00

GiteaMirror closed this issue

2025-11-02 12:06:32 -06:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#16276